rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-8359 Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS
When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule function in the dll would be called to set up a "module" object for that module. However, WOSHttpStatusModule.dll is not present in the installation. As a result, a function pointer to WOSBin_LoadHttpModule (which would have been in the export table in WOSHttpStatusModule.dll) is set to NULL, resulting in calling a function at address 0.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL pointer dereference
Affected products: vendor: Gladinet
product: Triofox
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2026-05-27T19:49:18.405Z
CVE-2026-8360 Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS
Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no user is logged into the Triofox Server Agent Management Console).  The returned NULL pointer is not checked before being dereferenced.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL pointer dereference
Affected products: vendor: Gladinet
product: Triofox
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2026-05-27T19:47:29.646Z
CVE-2026-8361 Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dll
A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome
Problem types: cwe_id: CWE-23
description: CWE-23 Relative path traversal
Affected products: vendor: Gladinet
product: Triofox
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2026-05-27T19:44:38.581Z
CVE-2026-8362 Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll
A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based buffer overflow
Affected products: vendor: Gladinet
product: Triofox
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-05-27T19:42:08.859Z
CVE-2026-8363 Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll
A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL path starting with /resources:
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based buffer overflow
Affected products: vendor: Gladinet
product: Triofox
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-05-27T19:40:33.139Z
CVE-2026-8364 Gladinet Triofox Missing Authentication for Critical Functions
Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources, /status, /sysinfo, /woshome, /Settings, /schedule, or /DavCache.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing authentication for critical function
Affected products: vendor: Gladinet
product: Triofox
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-05-27T19:38:01.455Z
CVE-2026-8367 aria2c Improper Certificate Validation
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper certificate validation
Affected products: vendor: aria2_project
product: aria2c
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: 2026-05-13T14:55:09.815Z
CVE-2026-8368 LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.

On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.

A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: OALDERS
product: LWP::UserAgent
default_status: unaffected
Credits: lang: en
value: Kai Aizen
Published: 2026-05-12T14:01:25.365Z
CVE-2026-8369 Improper Input Validation in OpenThread NAT64 Translator
Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security checks via crafted IPv4 packets with options.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: The OpenThread Authors
product: OpenThread
default_status: unaffected
Published: 2026-05-13T13:36:09.523Z
CVE-2026-8370 Automic Automation Agent Unix privilege escalation
Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, Solaris Sparc 64 allows Privilege Escalation, Target Programs with Elevated Privileges.

This issue affects Automic Automation: < 24.4.4 HF1.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with unnecessary privileges
Affected products: vendor: Broadcom
product: Automic Automation
default_status: unaffected
Credits: lang: en
value: David Suchy, Citadelo (citadelo.com)
Published: 2026-05-19T18:42:00.155Z
CVE-2026-8376 Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.

A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
Problem types: cwe_id: CWE-680
description: CWE-680 Integer Overflow to Buffer Overflow
Affected products: vendor: SHAY
product: perl
default_status: unaffected
Published: 2026-05-25T23:53:27.812Z
CVE-2026-8381 Broken Access Control in TeamViewer DEX Platform (On Premises)
A broken access
control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain backend API endpoints do not
correctly enforce authorization checks, allowing an authenticated user with low
privileges to perform actions and access resources intended only for higher‑privileged roles. An attacker with
low‑privileged credentials may exploit
this to gain unauthorized access to administrative or sensitive functionality.
Problem types: cwe_id: CWE-862
description: CWE-862 – Missing Authorization
Affected products: vendor: TeamViewer
product: DEX (On-premises)
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published: 2026-05-22T08:29:16.451Z
CVE-2026-8382 Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: wpengine
product: Advanced Custom Fields (ACF®)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Sarawut Poolkhet
Published: 2026-05-31T02:28:00.276Z
CVE-2026-8388 Incorrect boundary conditions in the JavaScript Engine: JIT component
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: ggwhyp
Published: 2026-05-12T12:36:10.633Z
CVE-2026-8389 JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: ggwhyp
Published: 2026-05-12T12:36:12.516Z
CVE-2026-8390 Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: OpenAI Preparedness, Bill Demirkapi
Published: 2026-05-12T12:36:13.948Z
CVE-2026-8391 Other issue in the JavaScript Engine component
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: ggwhyp
Published: 2026-05-12T12:36:15.548Z
CVE-2026-8398 
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Problem types: cwe_id: CWE-506
description: CWE-506: Embedded Malicious Code
Affected products: vendor: AVB Disc Soft
product: DAEMON Tools Lite
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Igor Kuznetsov (Kaspersky)
lang: en
value: Georgy Kucherin (Kaspersky)
lang: en
value: Leonid Bezvershenko (Kaspersky)
lang: en
value: Anton Kargin (Kaspersky)
Published: 2026-05-15T07:30:29.287Z
CVE-2026-8401 Sandbox escape in the Profile Backup component
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: ggwhyp
Published: 2026-05-12T14:24:33.320Z
CVE-2026-8404 Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.
Problem types: cwe_id: CWE-178
description: CWE-178: Improper Handling of Case Sensitivity
Affected products: vendor: djangoproject
product: Django
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
baseScore: 3.1
baseSeverity: LOW
Credits: lang: en
value: Ahmed Badawe
lang: en
value: Jake Howard
lang: en
value: Natalia Bidart
Published: 2026-06-03T13:16:29.593Z
CVE-2026-8405 IBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerability
IBM Guardium Data Protection 12.2.1, and 12.2.2 's add-on feature of Guardium Data Protection named "Long Term Retention" (LTR) can expose sensitive credentials in debug mode.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: Guardium Data Protection
cpes: cpe:2.3:a:ibm:guardium_data_protection:12.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:guardium_data_protection:12.2.2:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2026-05-27T13:20:52.982Z
CVE-2026-8407 
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints.



This issue affects the following versions :

  *  

Devolutions Server 2026.1.6.0 through 2026.1.11.0


  *  

Devolutions Server 2025.3.16.0 and earlier
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-05-12T16:16:50.924Z
CVE-2026-8409 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete.  The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:40:56.443Z
CVE-2026-8410 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete.  The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:32:53.373Z
CVE-2026-8411 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:32:01.804Z
CVE-2026-8412 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at 	concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:31:21.174Z
CVE-2026-8413 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:30:28.303Z
CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:29:50.712Z
CVE-2026-8415 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:29:13.458Z
CVE-2026-8416 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
cwe_id: CWE-1275
description: CWE-1275 Sensitive cookie with improper SameSite attribute
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Yonatan Drori (Tenzai)
Published: 2026-05-21T21:28:32.664Z
CVE-2026-8417 Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php checks only canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller. Because the endpoint is a state-changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.In order to be vulnerable, the victim must be passing canInstallPackages() and and a target package must already be already installed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks  https://github.com/maru1009  for reporting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Published: 2026-05-21T20:19:42.643Z