CVE Vulnerability Catalog

Concrete CMS version 9.5.0 and below contains a stored XSS vulnerability in the height parameter. The controller does not validate or sanitize the $height value, allowing users with editor privileges to inject malicious JavaScript executed in visitors' browsers.

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The <strong>...</strong> wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.

Concrete CMS version 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method only checks the canInstallPackages() permission before fetching a remote package and writing it to the DIR_PACKAGES directory. An attacker can force an authenticated administrator to download an arbitrary marketplace package.

Concrete CMS version 9.5.0 and below is vulnerable to unauthenticated file usage disclosure due to missing permission checks in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of pages referencing that file, including page IDs, handles, and full URLs, even for restricted pages.

Missing capability check in GSheet For Woo Importer plugin for WordPress (up to 2.3.1) allows authenticated attackers with Subscriber-level access to delete Google Sheets API token and configuration options.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests during the mobile (RouteMate) login flow. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before version 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false. An attacker on the network path can present a forged certificate to intercept authentication data.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing general-purpose outbound HTTPS requests via shared helper functions. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

Open ISES Tickets before version 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ticketsmdb_import.php. An authenticated attacker can inject arbitrary JavaScript via multiple POST parameters that are directly placed into HTML form hidden input value attributes.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in routes_i.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the value attribute of a hidden HTML form input.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in patient_w.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized id and ticket_id GET parameters that are directly placed into the action attribute of an HTML form.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in patient.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized id and ticket_id GET parameters that are directly placed into the action attribute of an HTML form.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in os_watch.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized ref and mode_orig POST parameters that are directly placed into the value attributes of hidden HTML form inputs.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in landb.php. An authenticated attacker can inject arbitrary JavaScript via the _type POST parameter, which is directly placed into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php. It allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213rr.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.