Missing authorization and visibility checks in a WP Directory Kit shortcode (WordPress plugin versions up to and including 1.5.7) allow any logged-in user with a role as low as Contributor to read non-public listing content — including password-protected entries and hidden fields — that belongs to other users. The flaw is an information-disclosure issue (CWE-200) publicly documented by WPScan with exploit detail available, though the EPSS score of 0.14% (4th percentile) and the absence of any CISA KEV entry indicate no confirmed active exploitation and low predicted mass-exploitation risk. Impact is confidentiality-only and limited in scope: no data modification, no denial of service, and no privilege escalation beyond the reading of restricted listing data.
Command injection in the D-Link DSL-3782 (firmware 2016-07-28) allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the Addr argument of the Diagnostics web interface endpoint at /cgi-bin/New_GUI/Set/Diagnostics.asp. A public proof-of-concept exploit is available on GitHub, and the device is almost certainly end-of-life with no patch forthcoming from D-Link. The provided CVSS 4.0 score of 2.1 significantly understates the true impact, as command injection on embedded routers typically yields full root-level OS control of the device.
Memory corruption in GPAC's scenegraph node management routine `gf_node_list_insert_child` (in `scenegraph/base_scenegraph.c`) can be triggered by a remote attacker delivering a crafted MPEG-4/BIFS scene file, causing a process crash (DoS). A publicly available proof-of-concept exploit (`poc_18_nstatx.zip`) is distributed via GitHub, lowering the exploitation bar. All GPAC releases up to commit f1219cde are affected; version abi-16.23 resolves the issue. No confirmed active exploitation campaign (not in CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in GPAC's MPEG Video Reframer filter exposes users of versions up to commit f1219cde to memory corruption when processing a malformed MPEG video file. The vulnerable function mpgviddmx_process() in filters/reframe_mpgvid.c previously relied on gf_assert() to validate MPEG start codes without first confirming the buffer contains at least 3 bytes, enabling heap corruption on crafted input. A proof-of-concept exploit has been publicly disclosed via GitHub; no CISA KEV listing or confirmed active exploitation exists at time of analysis.
A resource-exhaustion (denial of service) flaw in vLLM's OpenAI-compatible /v1/chat/completions endpoint lets a caller- or model-supplied Jinja chat_template drive nested range() loops whose evaluation cost grows as O(N^depth), tying up a request-runtime worker thread for tens of seconds. vLLM releases up to and including 0.27.1 are affected (EUVD lists 0.27.0 and 0.27.1), with the CPE range expressed as vllm-project:vllm:* so earlier releases are plausibly in scope too. Publicly available exploit code exists, and CVSS 4.0 rates the issue only 2.1 with availability impact rated Low; a fix PR that introduces a minijinja evaluation 'fuel' budget is still awaiting acceptance.
Use-after-free in GPAC's scenegraph node handling allows a remote attacker to trigger memory corruption by delivering a crafted media file that is processed by the affected application. The vulnerability exists in `gf_node_get_name_and_id()` in `scenegraph/base_scenegraph.c`, where a node pointer could be dereferenced after being freed due to missing null/reference-count guards in the BIFS decoder's command assignment path. Exploitation requires user interaction (opening a malicious file), a publicly available proof-of-concept exists (poc_16_bt.zip), and no confirmed active exploitation is recorded in CISA KEV.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
Improper access control in PHPGurukul Hostel Management System 3.0 allows an attacker to bypass authorization checks in the admin login handler /admin/includes/checklogin.php by manipulating the ID parameter, granting unauthorized access to administrative functionality. Exploitation is remotely reachable and publicly available exploit code exists (tracked via a GitHub PoC issue and VulDB entry), though the per-component impact is limited to low confidentiality, integrity and availability loss. EPSS/KEV signals are absent from the provided data, and the published CVSS 4.0 base metrics (AV:N/AC:L/PR:L/UI:N, all impacts Low) indicate a modest real-world risk rather than mass-exploitation potential.
Stored/reflected cross-site scripting in code-projects Record Management System 1.0 allows an attacker to inject JavaScript through the 'desc' parameter processed by main/reg.php, which then executes in the browser of any user viewing the affected page. The flaw is remotely reachable without authentication, though it does require a victim to interact with the poisoned page or field. Publicly available exploit code exists (a GitHub write-up demonstrating the payload), but the issue is not listed in CISA KEV and no EPSS signal was supplied, so exploitation in the wild has not been confirmed. The CVSS 4.0 base score of 5.3 is moderate; the practical impact is limited to session theft, credential phishing, or defacement within the deployed instance rather than server compromise.
OS command injection in the exportOvpn handler of the TOTOLINK X5000R router firmware (9.1.0cu.2089_B20211224 and potentially other versions) allows an authenticated web-UI user to inject shell metacharacters through the 'filetype' argument supplied to /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user, resulting in commands executed with the privileges of the underlying CGI process. The flaw is remotely reachable (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N) and publicly available exploit code exists, so any X5000R with an exposed or weakly-credentialed management interface should be treated as at risk. Impact per the supplied vector is limited (VC:L/VI:L/VA:L) but on an embedded device a successful injection typically yields full control of the appliance and its configuration.
Unrestricted file upload in WuzhiCMS 4.0 and 4.1.0 allows an authenticated user to upload arbitrary files through the avatar upload handler (member::setAvatar at /index.php?m=member&f=user&v=setAvatar), which can lead to remote code execution if the uploaded file is a server-executable script placed in a web-accessible directory. The vendor was notified via a public issue report but has not responded, so no official fix exists. Public exploit code is available (GitHub issue 219), though the flaw is not listed in CISA KEV, so active exploitation is unconfirmed.
Stored cross-site scripting in PHPGurukul Daily Expense Tracker System 1.1 allows an authenticated attacker to inject malicious JavaScript via the FullName parameter handled by /dets/includes/sidebar.php. Because sidebar content is rendered for other users viewing the application, the payload executes in victims' browsers, enabling session hijacking or credential theft against other authenticated users or administrators. A public proof-of-concept is available via GitHub, though no active exploitation has been confirmed in CISA KEV.
Cross-site scripting (CWE-79) in PHPGurukul Hostel Management System 3.0 lets an attacker inject script through the admin-side /admin/manage-students.php page, which is then rendered without adequate output encoding. Publicly available exploit code exists, so a working payload is already circulating against a target set that is mostly small institutional or academic deployments. The CVSS 4.0 score of 1.9 is low because the vector requires high privileges (PR:H) and user interaction (UI:P), with only a limited integrity impact and no confidentiality or availability loss recorded.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
We need produce JSON per schema. Let's analyze. CVE-2026-91779: GNU Binutils 2.47, function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, null pointer dereference, local attack, CVSS 1.9 (CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L...). CWE-476. POC publicly available. Reported by VulDB. CPE gnu:binutils. Tags: Denial Of Service, Null Pointer Dereference, Binutils, Gnu. EUVD affected: Binutils 2.47. References include sourceware bugzilla 34446, exploit GitHub. Need fields. Product name: "GNU Binutils" (1-3 words). Summary: Original synthesis. Start with impact and product. "A local null pointer dereference in GNU Binutils 2.47's ELF exception-handling frame parser allows crafted object files to crash tools like objdump, ld, or readelf..." Mention local, POC public, CVSS low 1.9, DoS only. Avoid "A vulnerability..." start. Let's craft 2-3 sentences. Technical context: Explain binutils, BFD library, elf-eh-frame.c, EH frame handling; CWE-476 null pointer dereference; local attack requires processing malicious ELF file with crafted .eh_frame section. Mention CPE gnu:binutils. Risk assessment: CVSS 4.0 1.9 with AV:L, PR:L, VA:L only; EPSS not provided; KEV not listed; POC publicly available (per input "exploit has been released to public"). Note exploitability limited: local, requires user to run binutils tool on crafted file, low impact (DoS only). State EPSS missing. SSVC not provided. Affected products: GNU Binutils 2.47; CPE gnu:binutils:*; EUVD says 2.47; references sourceware bugzilla. Remediation: No patch identified; project informed but not responded. Compensating controls: avoid processing untrusted ELF files with binutils tools, sandbox, validate input, use alternative tools, monitor for crash. Mention advisory URLs. Since patch status says not available -> "No vendor-released patch identified at time of analysis." But input says project informed but has not responded. So state that. Exploit scenario: local attacker provides mal
A null pointer dereference in GNU Binutils 2.47 lets a locally-supplied malformed ELF object crash the toolchain when the linker or related BFD-consuming utilities reach the elf_x86_allocate_dynrelocs() dynamic-relocation allocator in bfd/elfxx-x86.c. Only availability is impacted — the fault aborts the affected utility and no memory corruption, information disclosure, or code execution has been demonstrated, which is consistent with the CVSS 4.0 base score of 1.9 (AV:L/PR:L, VA:L only). Publicly available exploit code exists in a GitHub proof-of-concept repository linked from the NVD record, but there is no indication of active exploitation or CISA KEV listing; upgrading to Binutils 2.48 resolves the issue.
OpenBankProject OBP-API builds up to and including 1.10.1 deserialize attacker-controlled data through the KryoInjection.invert routine in the Redis cache handler (code/api/cache/Redis.scala), which can lead to code execution or data tampering by anyone able to plant a crafted Kryo-serialized object in the API's Redis cache. Exploitation is rated difficult: the supplied CVSS 4.0 vector requires high privileges (PR:H) and high attack complexity (AC:H), and the scored impact is limited (VC:L/VI:L/VA:L, score 1.2). Public exploit material exists via the referenced GitHub issue (GHSA-889g-wggr-jrrq / issue 2888), but there is no CISA KEV confirmation of active exploitation, and the upstream project had not responded to the issue report at the time of analysis.
Stack exhaustion via unbounded recursion in GPAC's scenegraph node activation routine allows a local attacker to crash the application or corrupt memory when a malicious or malformed multimedia scene file is opened. Affected versions up to commit f1219cde lack a recursion depth guard in gf_node_activate_ex and gf_node_deactivate_ex, enabling crafted cyclic or deeply nested VRML/X3D/XMT scene graphs to exhaust the call stack. A publicly available proof-of-concept (poc_17_nstatx.zip) exists; however, no active exploitation has been confirmed and impact is limited to low integrity and availability consequences on the local system.
Incomplete comparison logic in OpenClaw ClawScan's built-in static scanner (internal/runner/static_scanner.go) through version 0.1.6 lets packaged Python bytecode slip past the deterministic text scan, so malicious skills or OpenClaw plugins can pass inspection undetected. The vendor fix in v0.1.7 (commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41) explicitly adds flagging of packaged Python bytecode as opaque executable content. A publicly available exploit (GitHub issue #40) demonstrates the bypass, but the flaw is local-only, requires a low-privileged local user plus passive user interaction, and yields only a low integrity impact (CVSS 4.0 base 0.9).
ClawScan 0.1.6 and earlier misclassifies NUL-obfuscated or otherwise ambiguous files as opaque binary content, so its built-in static scanner skips them and malicious OpenClaw skill or plugin code passes inspection undetected. Exploitation requires local access and the victim to run or act on a ClawScan report, giving the attacker a way to smuggle hostile code past the only automated gate. Public exploit code exists (GitHub issue #42), and the defect is resolved in 0.1.7 via commit 04401337b3adb9343bd338b21e5e258bf49ca9c8; CVSS 4.0 base score is 2.4, reflecting the limited integrity-only, local impact.
WSO2 Identity Server exposes a user-enumeration weakness in its SMS OTP login flow: the error messages returned when the OTP challenge is initiated differ depending on whether the supplied account exists, giving unauthenticated remote attackers a way to confirm valid usernames. The signal is strongest for accounts that have no mobile number registered, which produce a distinct response. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is only 3.7 — the practical value to an attacker is the harvested username list, which feeds later brute-force and social-engineering campaigns rather than yielding direct compromise.
A memory leak in the gss-ntlmssp NTLM target-info parser allows a malicious or man-in-the-middle NTLM server to gradually exhaust memory on the client by sending a crafted NTLM CHALLENGE message containing duplicated string-valued AV_PAIR entries. Each duplicate causes the parser to allocate a new string buffer without freeing the previous one, so repeated authentications accumulate leaked allocations and eventually degrade or crash the client, producing a denial of service. The impact is availability-only and low severity (CVSS 3.7, A:L), exploitation requires an attacker to control the NTLM challenge, and no public exploit code or CISA KEV listing was identified at time of analysis.
Oracle VM VirtualBox 7.2.16 contains a flaw in the Core component that lets a high-privileged attacker who already has a logon on the host trigger a partial denial of service against the VirtualBox process itself. The attack is local (AV:L) and requires elevated privileges (PR:H), but carries a scope change (S:C), meaning the successful exploit can significantly affect additional products layered on the same infrastructure. CVSS 3.1 scores this 3.2 with availability-only impact; there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low for most deployments.
Oracle VM VirtualBox 7.2.16 (Core component) contains a low-severity information disclosure flaw that requires an attacker to already hold a high-privileged logon on the host where VirtualBox runs. A successful attack yields read access to a limited subset of VirtualBox-accessible data (C:L) and, per Oracle's scope-change rating, may affect components beyond the hypervisor boundary. No public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score is only 3.2, so real-world prioritization should be low relative to other virtualization issues.
Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.
Cross-origin data disclosure in Google Chrome prior to 153.0.8010.47: a race condition (TOCTOU) in the browser's Network component lets a remote attacker who has already achieved code execution inside the renderer process read data belonging to other origins by luring a victim to a crafted HTML page. The impact is limited to confidentiality of cross-origin responses (C:L, I:N, A:N), and exploitation is rated High complexity with required user interaction; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the vendor has shipped a fix in 153.0.8010.47.
Partial denial of service in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (Access SDK component) can be triggered by a low-privileged, authenticated attacker who reaches the product over HTTP. The flaw is rated CVSS 3.1 base 3.1 with an availability-only, partial impact, and Oracle characterizes it as difficult to exploit (AC:H), so successful disruption requires favorable timing or state rather than a simple repeatable request. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so there is no indication of active exploitation at time of analysis.
PHPGurukul Blood Donor Management System 1.0 stores credentials in cleartext on disk when crafted values are supplied to the password, email, currentpassword, dbcurrentpwd, or newpassword arguments handled by application/models/admin/Login_Model.php. Vulnerable code paths are reachable remotely per the CVSS 4.0 vector (AV:N/PR:N/UI:N), although exploitation complexity is rated high (AC:H) and only a low confidentiality impact is scored. Publicly available exploit code exists and is flagged with an Exploit maturity of P in the CVSS vector, so the flaw should be treated as exploitable even though the base score is only 2.9 and no CISA KEV entry is present.
Oracle Coherence 15.1.1.0.0 exposes a narrow local information-disclosure weakness in its Core component that lets an attacker who already holds a low-privileged operating-system logon on the Coherence host read a limited subset of data the process can access. The flaw is rated CVSS 3.1 base 2.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning high attack complexity, no integrity or availability impact, and no remote vector. There is no public exploit code and no CISA KEV listing, so this is a low-priority, defense-in-depth item rather than an emergency; Oracle published it through its Critical Patch Update advisory for Fusion Middleware.
Heap out-of-bounds access in GPAC's URL concatenation utility (`utils/url.c`) allows a local low-privileged attacker to trigger memory corruption when the `gf_url_concatenate_ex` function processes a crafted URL that results in an empty temporary buffer. The trailing-whitespace trim loop computes `tmp[strlen(tmp)-1]` without first checking that `tmp` is non-empty, accessing heap memory at index -1. Exploitation requires local system access and user interaction; no public exploit exists and the vulnerability is not listed in CISA KEV. The fix is available in GPAC release abi-16.23.
Concrete CMS 8.5.3 through 9.5.2 lets a suspended or deactivated user keep minting valid OAuth 2.0 access tokens through the refresh-token grant, because the grant never re-checks the account's active flag (uIsActive=0) before issuing new tokens. Anyone who legitimately obtained a refresh token while their account was active retains API access after offboarding, so deactivation alone no longer revokes API credentials. The vendor assigned a low CVSS v4.0 base score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N, all impacts Low); no public exploit code or CISA KEV listing was provided at time of analysis.
Cross-site request forgery in the Concrete CMS dashboard 'SEO Excluded Words' reset action lets a remote attacker who lures an authenticated administrator to a crafted page silently wipe the site's reserved-word list (concrete.seo.exclude_words) and restore vendor defaults, in every release below 9.5.3. The reset() controller validated neither the anti-CSRF token emitted by its own modal nor the HTTP method, so a cross-site request from the victim's authenticated browser is honoured. The impact is integrity-only and narrowly scoped — future automatically generated URL slugs for pages, files and topics stop honouring the site's SEO policy — and the vendor rates it CVSS 4.0 2.3; no public exploit code or CISA KEV entry was identified at the time of analysis.
Concrete CMS versions 9.0.0 through 9.5.2 fail to validate a CSRF token on the dashboard group type controller's delete action, allowing a remote attacker to force a logged-in administrator into deleting a custom group type. The attacker needs no authentication of their own but must lure a victim who holds group type management permission into visiting a malicious page while logged in, which is why the vendor rated it only 2.3 under CVSS 4.0. There is no indication of active exploitation or public exploit code, and the issue is fixed in the 9.5.3 release.
Concrete CMS versions below 9.5.3 import files uploaded through the conversation attachment endpoint into the site's file manager before verifying the 'Add Message Attachments' permission, so the authorization check happens only after the file has already been stored. A low-privileged authenticated user who has been explicitly denied that permission — or an unauthenticated visitor on a site configured to allow guest posting — can therefore inject files of allowed types into the file manager, altering stored content or consuming storage. The vendor rates this CVSS v4.0 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L), indicating limited integrity and availability impact rather than code execution, and there is no public exploit code identified at time of analysis.
Stored cross-site scripting in Concrete CMS 5.0.0 through 9.5.2 lets an unauthenticated attacker inject raw HTML through a publicly accessible Express Form; the payload is rendered unsanitized as an Express entry label whenever associated entries are displayed, executing in an administrator's dashboard session and in the browsers of visitors to pages containing an Express Entry List block with association columns. The Concrete CMS security team rates this CVSS v4.0 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P), reflecting that exploitation depends on specific Express configuration and passive victim interaction rather than open, unconditional exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and fixed code is available in Concrete CMS 9.5.3.
Concrete CMS versions below 9.5.3 fail to validate an anti-CSRF token on the block-arrangement backend endpoint (Concrete\Controller\Backend\Page\ArrangeBlocks::arrange), so a session-holding content editor can be tricked into silently reordering or moving blocks in the draft of a page they are allowed to edit. Exploitation is browser-driven cross-site request forgery: the attacker needs only to lure a logged-in editor to an attacker-controlled page while the default null SameSite cookie setting lets the victim's session cookie ride along with the forged request. Impact is limited to integrity of draft content layout (CVSS v4.0 2.3, CWE-352); no public exploit code and no active exploitation are indicated in the supplied intelligence, and no EPSS score was provided.
Use-after-free in FreeRDP's smartcard RDPDR device handler (before 3.31.0) allows a malicious or compromised RDP server to free a registered device pointer while the device manager still holds a reference, producing a dangling pointer that can crash the client or potentially be leveraged for code execution in the victim's session. The flaw is only reachable when a client with smartcard redirection enabled connects to an attacker-controlled RDP endpoint and the attacker can force a worker-thread creation failure during channel setup — a narrow, non-deterministic window reflected in the low CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P, availability-only impact). A vendor patch is available in FreeRDP 3.31.0; no public exploit code and no CISA KEV listing were identified at time of analysis.
We need to produce JSON. Let's analyze. CVE-2026-81925: Concrete CMS before 9.5.3, reflected XSS via custom date format in conversation messages, CSRF missing token, auto-submitting cross-origin POST without authentication. CVSS v4.0 2.1 vector: AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Interesting: PR:L (low privileges), UI:P (passive), AT:P (attack requirements present). CVSS 3.1 equivalent... Let's think. Our own assessed CVSS 3.1 vector. Given it requires tricking user into submitting crafted POST, no CSRF token, PR:L in v4.0 means attacker needs low privileges? Actually PR:L in v4.0 means the attacker requires privileges... Hmm, in v4.0 PR is about the attacker's required privileges on the vulnerable system. PR:L suggests attacker needs some low-level privileges (e.g., an account?). But description says "without authentication" — payload delivered via auto-submitting cross-origin POST without authentication. Hmm, that suggests PR:N. But vendor gave PR:L. There's ambiguity. Actually the reflected XSS requires the victim to be authenticated? The custom date format is user-supplied... "improperly neutralized a user-supplied custom date format when rendering conversation messages" — so the attacker submits a crafted POST with custom date format, and the response reflects it. If the victim needs to be a logged-in user viewing their own profile settings? Hmm. The description says exploitation aided by absence of CSRF token on endpoint which allowed payload delivered through auto-submitting cross-origin POST without authentication. So the attacker doesn't need authentication to trigger the request, but the victim must be tricked into submitting? Actually auto-submitting cross-origin POST is triggered in victim's browser. The XSS executes in the victim's browser session. So if victim is logged into Concrete CMS, the script runs in their session. But the endpoint might not require auth... The CVSS says PR:L, UI:P. UI:P (passive) means the user must perfo
Concrete CMS 9.0.0 through 9.5.2 lets an authenticated user who holds only the global access_sitemap permission reorder any page in the site tree, including pages they have no rights to edit, because the dashboard sitemap reorder controller (Concrete\Controller\Backend\Dashboard\SitemapUpdate) never checks per-page edit permission before writing each page's cDisplayOrder value. The same action validates no CSRF token, so a forged request from a sitemap-privileged victim's browser can perform the write silently, changing the order in which pages appear in navigation menus, breadcrumbs, and page lists. Concrete CMS shipped a fix in 9.5.3; the vendor rates the issue CVSS v4.0 2.1 (integrity-only, no confidentiality or availability impact), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Server-side request forgery in Concrete CMS 9.0.0 through 9.5.2 allows an authenticated user who holds file-import privileges to make the server fetch internal-only resources by abusing a DNS pin that is validated once per host and then reused for every later URL on that host. Because the pinned validation and the unpinned download can resolve to different addresses, a rebinding host can redirect the request to loopback services, internal admin panels, or cloud metadata endpoints, with responses saved into the file manager. The vendor rates this only CVSS 4.0 base 2.1 given the high complexity and privileged prerequisite; no public exploit code or CISA KEV entry was identified at time of analysis.
Concrete CMS 9.0.0 through 9.5.2 contains an insecure direct object reference in the Express saved search preset delete and edit dialogs, letting any authenticated user who holds only view permission on a single Express entity permanently delete (with no undo) or rename saved search presets owned by Express entities they have no permission over. Because a renamed preset is rendered back to users of the targeted entity, the flaw enables content defacement or social-engineering-style manipulation of other teams' saved searches. The vendor scored it CVSS 4.0 2.1 (Low) with PR:H and AT:P; no public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis.
Concrete CMS 9.5.2 and earlier fail to enforce a destination-side authorization check and omit CSRF token validation in the multilingual page-assignment backend action (Backend\Page\Multilingual::assign), letting an authenticated editor who holds the Edit Page Multilingual Settings permission on just one page rebind an arbitrary page from another locale as that page's translation and delete legitimate translation pairs maintained by other editors. The result is silent manipulation of public-facing language routing across the site, with no confidentiality impact and only limited integrity/availability damage. The vendor scores this 2.1 (CVSS v4.0) because the actor must already be an authenticated, privileged editor; no public exploit code and no active exploitation have been reported.
Cross-site request forgery in Concrete CMS before 9.5.3 lets a remote attacker silently create theme page-template records inside a logged-in administrator's session. The Dashboard theme Inspect controller's activate_files() action accepts attacker-supplied pageTemplates[] values without validating an anti-CSRF token, so a forged auto-submitting POST from a page the admin merely visits is honored as legitimate. Impact is limited to unauthorized configuration change (integrity only, CVSS v4.0 base 2.1), and no public exploit code or CISA KEV entry was identified at time of analysis.
Concrete CMS versions before 9.5.3 contain a missing-authorization flaw in the SEO Bulk Update Meta Tags editor: the saveRecord() action validated the per-page CSRF token but never invoked canEditPageProperties() for the target page. As a result, an authenticated user who was granted access to the bulk SEO tool and could merely view a page could rewrite that page's meta title, meta description, and URL handle, tampering with presentation content and live URLs outside their intended edit scope. The vendor rates this only 2.1 (CVSS v4.0, integrity-only), there is no public exploit code identified at time of analysis, and the issue is not known to be actively exploited (no CISA KEV listing).
Authenticated users with editor-level or higher privileges in Concrete CMS 9.x before 9.5.3 can degrade site availability by submitting keyword searches packed with SQL LIKE wildcard characters, which the application failed to escape before placing them into the LIKE clause. Because a single-character wildcard matches any row, a short request forces the database into full-table scans, and repeated or wildcard-dense searches can sustain elevated database CPU and I/O on large installations, slowing the site for all users. The Concrete CMS security team rated this CVSS v4.0 2.1 (availability-only, attack requirements present, high privileges); no public exploit code has been identified at time of analysis.
Broken authorization in the Concrete CMS 9 Boards dashboard area (versions 9 through 9.5.2) lets any user who has been granted edit_board_settings on a single board view, refresh, regenerate, or delete board instances belonging to entirely different boards by supplying those boards' instance IDs. The affected single-page controllers resolve an instance directly from the attacker-supplied ID and validate only an action-scoped CSRF token — which is bound to the action name, not to the target object, and is therefore reusable across boards — while skipping the permission-checked accessor that runs canEditBoardSettings on the parent board for the read view. The vendor rates this CVSS v4.0 2.1 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L); no public exploit code or CISA KEV listing was identified at time of analysis.
Missing authorization in the Express entries advanced-search dashboard action of Concrete CMS 9.0.0 through 9.5.2 lets any authenticated dashboard user who holds view_express_entries on just one Express entity read the entries and secret attribute values of every other Express entity. The advanced_search() method resolves the target entity directly from a user-supplied entity ID and skips the canViewExpressEntries() check that the sibling results() action enforces, crossing the per-entity permission boundary Express is designed to guarantee. The vendor rates this CVSS v4.0 2.1 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:L), reflecting a low-impact but real confidentiality breach limited to authenticated staff; no public exploit code or CISA KEV entry was identified at time of analysis.
Concrete CMS 9 through 9.5.2 fails to verify ownership when processing three Boards data-source dashboard actions (update, update_data_source, delete_data_source), so an authenticated user with edit_board_settings on just one board can modify or permanently delete the configured data sources of any other board on the site. Successful abuse halts the victim board's content feed and resets its custom weighting, with no confidentiality impact. The vendor-assigned CVSS v4.0 base score is a low 2.1 (PR:H, AT:P), no public exploit code or CISA KEV entry was provided in the intelligence feed, and the referenced fix is the Concrete CMS 9.5.3 release notes.