Cerebrate-project Cerebrate — known CVE vulnerabilities

Every CVE whose affected-product data names Cerebrate-project Cerebrate, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (9)

• CVE-2023-28883 — CVSS 9.8 (critical): In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
• CVE-2023-26468 — CVSS 9.1 (critical): Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
• CVE-2022-25317 — CVSS 6.1 (medium): An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.
• CVE-2022-25321 — CVSS 6.1 (medium): An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
• CVE-2023-41908 — CVSS 5.3 (medium): Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
• CVE-2022-25319 — CVSS 5.3 (medium): An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.
• CVE-2022-25320 — CVSS 5.3 (medium): An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.
• CVE-2022-25318 — CVSS 4.3 (medium): An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing…
• CVE-2023-41363 — CVSS 4.3 (medium): In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.