CVE-2026-3240

Concrete CMS

CVE-2026-3240

In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with...

CVE-2026-3240: Improper Neutralization of Input During Web Page Generation

In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with...

Concrete CMS 安全漏洞

Concrete CMS is an open-source content management system developed by Concrete CMS. Versions of Concrete CMS prior to 9.4.8 contained a security vulnerability. This vulnerability stemmed from a stored cross-site scripting vulnerability in the Question field of the Legacy form element, which could...

Exploring Semantic Labeling Strategies for Third-Party Cybersecurity Risk Assessment Questionnaires

Third-Party Risk Assessment TPRA is a core cybersecurity practice for evaluating suppliers against standards such as ISO/IEC 27001 and NIST. TPRA questionnaires are typically drawn from large repositories of security and compliance questions, yet tailoring assessments to organizational needs...

CVE-2026-24422

Summary: CVE-2026-24422 affects phpMyFAQ prior to 4.0.17, where public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() uses Question::getAll() with showAll=true by default, returning non-public records (isVisible=f...

CVE-2026-24422: Exposure of Sensitive Information to an Unauthorized Actor

phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list endpoint calls Question::getAll with showAll=true by default, returning...

This Week in Spring - January 20th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's already the 20th of January and we are off on yet another rip roarin' adventure as we look at the week that has been... this week in Spring! even more good stuff from Spring AI team legend Christian Tsolov, this one on...

Microsoft Azure Cognitive Service for Language Elevation of Privilege Vulnerability

Microsoft Azure Cognitive Service for Language is a cloud-based natural language processing service from Microsoft USA. An elevation of privilege vulnerability exists in Microsoft Azure Cognitive Service for Language, which is caused by a flaw in a customized question and answer. An attacker coul...

CVE-2025-64663

Custom Question Answering Elevation of Privilege Vulnerability...

CVE-2025-64663

Custom Question Answering Elevation of Privilege Vulnerability...

EUVD-2025-204416

Custom Question Answering Elevation of Privilege Vulnerability...

CVE-2025-64663 Custom Question Answering Elevation of Privilege Vulnerability

...

CVE-2025-64663

Custom Question Answering Elevation of Privilege Vulnerability...

CVE-2025-64663 Custom Question Answering Elevation of Privilege Vulnerability

...

CVE-2025-64663

CVE-2025-64663 affects Microsoft Azure Cognitive Service for Language, specifically the Custom Question Answering component. The flaw is described as an Elevation of Privilege vulnerability caused by a flaw in the customized question and answer flow, enabling an attacker to gain elevated privileg...

Custom Question Answering Elevation of Privilege Vulnerability

...

CVE-2025-64663: Server-Side Request Forgery (SSRF)

Custom Question Answering Elevation of Privilege Vulnerability...

KLA90827 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Azure Cosmos DB can...

PT-2025-52357

Name of the Vulnerable Software and Affected Versions Custom Question Answering affected versions not specified Description An elevation of privilege issue exists in Custom Question Answering. The issue allows for privilege escalation. No information is available regarding the number of potential...