Cerebrate-Project Cerebrate
10 CVEs affecting Cerebrate-Project Cerebrate. Latest disclosed: 2025-11-28. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28883 | Critical | 9.8 | 2023-03-27 | In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint. |
CVE-2023-26468 | Critical | 9.1 | 2023-02-24 | Cerebrate 1.12 does not properly consider organisation_id during creation of API keys. |
CVE-2022-25321 | Medium | 6.1 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component. |
CVE-2022-25317 | Medium | 6.1 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description. |
CVE-2023-41908 | Medium | 5.3 | 2023-09-05 | Cerebrate before 1.15 lacks the Secure attribute for the session cookie. |
CVE-2022-25320 | Medium | 5.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. Username enumeration could occur. |
CVE-2022-25319 | Medium | 5.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled. |
CVE-2023-41363 | Medium | 4.3 | 2023-08-29 | In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users. |
CVE-2022-25318 | Medium | 4.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups. |
CVE-2025-66385 | | 2025-11-28 | UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as adm… |