9 matches found
CVE-2026-68527 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...
CVE-2026-68527
Concrete CMS 8.3.0 through 9.5.2 contains an authorization bypass (cross-calendar IDOR) in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog validated permissions against the calendar identifier supplied in the request rather than the calendar actually owning...
CVE-2026-68527 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...
CVE-2026-68527 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...
CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...
GHSA-M9FQ-C9HP-59G7 Cross-site Scripting in yourls
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in edit dialog...
Cross-site Scripting in yourls
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in edit dialog...
