CVE-2026-95674

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

EUVD-2026-84392

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

CVE-2026-95674

This vulnerability affects MISP (a threat intelligence platform), specifically the queryEnrichment method in EventsController.php. The root cause is a missing validation check: when a caller specified a module name not present in the instance's enabled modules list, the code silently continued pr...

PT-2026-96728

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description The queryEnrichment function in EventsController.php fails to properly validate the module name parameter. When a module name is provided that is not in the list of enabled modules, the system...

CVE-2026-95674: Improper Input Validation

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

CVE-2025-66384: Incorrect Provision of Specified Functionality

app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmpname...

CVE-2024-29859: Unrestricted Upload of File with Dangerous Type

In MISP before 2.4.187, addmispexport in app/Controller/EventsController.php does not properly check for a valid file upload...

CVE-2024-29859

In MISP before 2.4.187, addmispexport in app/Controller/EventsController.php does not properly check for a valid file upload...

CVE-2020-15412

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

CVE-2020-15412: Missing Authorization

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

PT-2020-14414

Name of the Vulnerable Software and Affected Versions MISP version 2.4.128 Description An issue was discovered in the EventsController.php file, specifically that it lacks an event ACL check before allowing a user to send an event contact form. This issue may potentially allow unauthorized access...