PT-2026-48637

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. In affected entities that did not explicitly mark id as inaccessible, an authenticated attacker could submit a crafted edit...

CVE-2026-11408

A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. Th...

CVE-2025-66386

app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin...

CVE-2025-66386: Relative Path Traversal

app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin...

CVE-2024-57969

app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...

CVE-2023-48656

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses...

CVE-2023-48657

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters...

CVE-2023-48657: Undefined Security Weakness

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters...

CVE-2023-48656: Undefined Security Weakness

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses...

CVE-2023-48658

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space...

CVE-2023-48657

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters...

CVE-2023-48656

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses...

MISP Security Vulnerabilities

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.176 that stems from...

CVE-2023-48658: Undefined Security Weakness

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space...

Design/Logic Flaw

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...

CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...

PT-2023-15707

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.166 Description The issue allows users to unsafely use the order parameter, which is related to several PHP files, including app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and...

CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...

CVE-2022-27245

An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF...

CVE-2022-27245: Server-Side Request Forgery (SSRF)

An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF...