Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.Check if you run itEPSS 0.19%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.Check if you run itEPSS 0.20%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.Check if you run itEPSS 0.64%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate.Check if you run itEPSS 0.68%May 21, 2026
- Low2.0Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized.Check if you run itEPSS 0.15%May 21, 2026
- Low2.1In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-int…Check if you run itEPSS 0.15%May 21, 2026
- Low2.3For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status.Check if you run itEPSS 0.17%May 21, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass.Check if you run itEPSS 0.29%May 21, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller.Check if you run itEPSS 0.12%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter.Check if you run itEPSS 0.21%May 21, 2026
- Medium6.3In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading p…Check if you run itEPSS 0.22%May 21, 2026
- Critical9.8The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_f…Check if you run itEPSS 0.70%May 21, 2026
- Medium5.1Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.Check if you run itEPSS 0.20%May 21, 2026
- Medium5.1Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text.Check if you run itEPSS 0.21%May 21, 2026
- Medium5.1In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.Check if you run itEPSS 0.17%May 21, 2026
- Medium5.1Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low…Check if you run itEPSS 0.22%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concre…Check if you run itEPSS 0.13%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/ .Check if you run itEPSS 0.17%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.Check if you run itEPSS 0.17%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/ .Check if you run itEPSS 0.12%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group.Check if you run itEPSS 0.30%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results i…Check if you run itEPSS 0.21%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure.Check if you run itEPSS 0.21%May 21, 2026
- High7.3Concrete CMS 9.5.0 and below has Stored XSS on the height parameter.Check if you run itEPSS 0.12%May 21, 2026
- High7.3Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name.Check if you run itEPSS 0.18%May 21, 2026
Sort