PT-2026-48637

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. In affected entities that did not explicitly mark id as inaccessible, an authenticated attacker could submit a crafted edit...

CVE-2025-66386: Relative Path Traversal

app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin...

CVE-2024-57969

app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...

CVE-2023-48656

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses...

CVE-2023-48657

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters...

CVE-2023-48656

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses...

CVE-2023-48658

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space...

CVE-2023-48657

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters...

CVE-2023-48658: Undefined Security Weakness

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space...

CVE-2023-48657: Undefined Security Weakness

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters...

MISP Security Vulnerabilities

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.176 that stems from...

CVE-2023-48656: Undefined Security Weakness

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses...

Design/Logic Flaw

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...

PT-2023-15707

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.166 Description The issue allows users to unsafely use the order parameter, which is related to several PHP files, including app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and...

CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...

CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...

CVE-2022-27245

An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF...

CVE-2022-27245: Server-Side Request Forgery (SSRF)

An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF...

CVE-2021-39302

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions'org' value...

PT-2021-22511

Name of the Vulnerable Software and Affected Versions MISP version 2.4.148 Description The issue allows SQL injection via the app/Model/Log.php $conditions'org' value in certain configurations. Recommendations For MISP version 2.4.148, consider restricting access to the app/Model/Log.php file unt...