Cerebrate-Project

10 CVEs across 1 Cerebrate-Project products. Browse Cerebrate-Project vulnerabilities, severities, and proof-of-concept exploits.

Cerebrate-Project products with known CVEs

Product	CVEs
Cerebrate	10

Cerebrate-Project CVEs — newest first
CVE	Severity	Score	Published	Summary
`CVE-2025-66385`			2025-11-28	UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as adm…
`CVE-2023-41908`	Medium	`5.3`	2023-09-05	Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
`CVE-2023-41363`	Medium	`4.3`	2023-08-29	In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
`CVE-2023-28883`	Critical	`9.8`	2023-03-27	In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
`CVE-2023-26468`	Critical	`9.1`	2023-02-24	Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
`CVE-2022-25321`	Medium	`6.1`	2022-02-18	An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
`CVE-2022-25320`	Medium	`5.3`	2022-02-18	An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.
`CVE-2022-25319`	Medium	`5.3`	2022-02-18	An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.
`CVE-2022-25318`	Medium	`4.3`	2022-02-18	An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.
`CVE-2022-25317`	Medium	`6.1`	2022-02-18	An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.