96 matches found
Cachet <=2.3.18 - SQL Injection
Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the SearchableTraitscopeSearch. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and...
cachet
Cachet, the open source self-hosted status page system. Cachet 3.x Announcement For more information on the Cachet rebuild and our plans for 3.x, you can read the announcement here. Requirements PHP 8.3 or later Composer A supported database: MariaDB, MySQL, PostgreSQL or SQLite Installation,...
CVE-2021-39174-PoC
CVE-2021-39174-PoC Cachet configuration leak dumper. CVE-2021-39174 PoC...
CVE-2021-39165
CVE-2021-39165 This Python script allows to exploit CVE-2021-39165 in Cachet prior to and including 2.3.18 automatically. References : https://github.com/fiveai/Cachet/security/advisories/GHSA-79mg-4w23-4fqc https://nvd.nist.gov/vuln/detail/CVE-2021-39165...
cachet_2.4.0-dev
CVE-2021-39174 Cachet 2.4.0-dev A python3 script for CVE-2021-39174 Cachet 2.4.0-dev Information Disclosure and RCE via Twig Server Side Template Injection. For the RCE the API KEY for the user is needed. Check out the Leave Songs link below which covers how to get the API KEY via SQL Injection...
CVE-2021-39172-RCE
CVE-2021-39172 Cachet 2.4: Code Execution via Laravel Configuration Injection blog post about the vulnerability https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/ you can use this for ctf or just for learning have fun and May God bless you all...
Cachet has Stored XSS in Incident Component
Summary A stored Cross-Site Scripting XSS vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover...
GHSA-X397-5HRV-J9M9 Cachet has Stored XSS in Incident Component
Summary A stored Cross-Site Scripting XSS vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover...
CVE-2026-113712
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...
EUVD-2026-105261
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...
CVE-2026-113712 Cachet has Stored XSS in Incident Component
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...
CVE-2026-113712 Cachet has Stored XSS in Incident Component
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...
CVE-2026-113712
The open-source status page system Cachet (versions 2.4.1 and earlier) contains a stored Cross-Site Scripting (XSS) vulnerability within the incident creation form. This flaw allows an authenticated attacker to inject malicious HTML or JavaScript, which then executes in the browser of any user vi...
PT-2026-118613
Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.4.2 Cachet version 3 Description A stored Cross-Site Scripting XSS issue exists in the incident creation form. An authenticated attacker can inject malicious HTML or JavaScript into the Incident Name and Incident...
CVE-2026-69118
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...
CVE-2026-69118
CVE-2026-69118 affects Cachet up to version 2.4.1. The vulnerability is a server-side template injection in incident template rendering that allows authenticated users to execute arbitrary PHP code, enabling remote code execution as the web server process. Attackers can craft malicious incident t...
CVE-2026-69118 Cachet 2.4.1 Authenticated Server-Side Template Injection RCE
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...
CVE-2026-69118 Cachet 2.4.1 Authenticated Server-Side Template Injection RCE
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...
EUVD-2026-55800
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...
CVE-2026-69118
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...