The absence of a password confirmation step when deactivating an account allows a CSRF request to potentially initiate the deactivation for an authenticated user.

CWE-352 Cross-Site Request Forgery (CSRF)


The Python-based data-exfiltration utility used by the Cl0p ransomware group (commonly distributed as part of the toolset during the 2023 – 2024 MoveIt campaigns) constructs operating-system commands by directly concatenating attacker-supplied strings without input sanitization. An authenticated endpoint on the Cl0p operators’ staging/collection host passes file-or directory-names received from compromised machines straight into a shell-escape sequence.

No official patch or cooperation from the malware authors is expected.

CWE-20 Improper Input Validation

Command Injection in Cl0p Exfiltration Python Script


Incorrect ACL for user settings edit, which previously allowed enumeration of usernames.

CAPEC-118 Collect and Analyze Information

CWE-203 Observable Discrepancy

CWE-204 Observable Response Discrepancy


A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Comments, Bundles, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models.

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

XSS in Comments, Bundles, and Sightings component of vulnerability-lookup


Insecure use of Markup in views/home which leads to potential reflected XSS.

Reflected XSS due to insecure use of Markup


Potential self XSS in admin in the CPE add interface in the models/organization.

Potential XSS in admin CPE in organization model


Missing email validation on user management when user change his/her password which means no email validation would have been seen by the user. This GCVE vulnerability is more informational than a directly exploitable vulnerability.

CWE-20 Improper Input Validation


Logged users can view vulnerability disclosure comments if they know the ID instead of the limited view (date of disclosure).

CWE-639 Authorization Bypass Through User-Controlled Key


A pre-auth user could self-assign a reporter without being authenticated

CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

CWE-20 Improper Input Validation


Raphael Lob from NATO Cyber Security Center

Arbitrary file-hash inclusion via templates in the template engine in MispAttribute allows a web user to obtain the MD5 hash of any file accessible to them via inclusion of tmp_name in templates.

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Arbitrary file hash inclusion via templates accessible to all users


Invalid check for uploaded file validity in EventsController can lead to arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request

Arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request


Potential vulnerability in file check upload but this vulnerability is non-exploitable as the code is never executed. This vulnerability information is kept for archiving.

Evaluation not possible due to dead-code

Potential vulnerability in file check upload but non-exploitable


Jeroen Pinoy from NATO Cyber Security Center

Authorization bypass / improper access control in app/Controller/SharingGroupBlueprintsController.php in MISP on web application /or API allows an authenticated low-privilege user to inject arbitrary organizations into existing sharing groups (including groups that should not be extendable), thereby granting those organizations access to shared resources and escalating access via crafted sharing-group blueprints or API requests that bypass validation.

Vulnerability in sharing group blueprints allowing sharing group injection


Cross-site scripting in Mermaid chart rendering component in MISP event report allows a remote attacker part of a MISP community to execute arbitrary JavaScript in the victim’s browser via injection of HTML tags in raw Mermaid charts synchronized through event reports.

XSS in event report via Mermaid diagram


Cross-site scripting in decaying tool simulation UI/component in MISP on web application allows an attacker/org who can set an organization's display name to execute arbitrary JavaScript in other users' browsers when they view or run simulations via a crafted organization name containing a script payload that is rendered unsanitized when a specific attribute is chosen for the simulation.

Potential XSS in decaying simulation tool


Local file inclusion in [ImportFromUrl() URL handling component in MISP event report (with pandoc support) on server-side document import feature / web application allows an attacker who can supply a URL to read local filesystem documents and disclose sensitive information (limited to document file types) via providing file:// URLs to ImportFromUrl() that are fetched without proper scheme/host validation.

CWE-552 Files or Directories Accessible to External Parties


Privilege escalation in UsersController::edit in Cerebrate Project (until version v1.29) allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id/organisation_id fields in the edit request.

CWE-269 Improper Privilege Management

Privilege escalation in Cerebrate allows an authenticated non-privileged user to escalate their privileges


A HTML injection issue was identified in Lookyloo’s web interface helper function shorten_string (website/web/__init__.py). The function was used to truncate and render user-controlled values inside HTML (for example in a <span title="..."> attribute) without first escaping the string. This allowed crafted input containing HTML to be injected into the rendered page.

On a standard Lookyloo installation, the configured Content Security Policy (CSP) significantly limited the impact and prevented direct script execution in most scenarios, but the underlying HTML injection bug was still present and could become exploitable if CSP was relaxed or modified.

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

If you don't upgrade, a proper CSP policy will avoid this vulnerability.


Esteban (Zerotistic) Tonglet during Hack the Government 2025 in Belgium

The “view picture” functionality in EventReport for site-administrators suffered from a path traversal vulnerability. When a specially crafted filename or alias was provided, the application could be tricked into returning arbitrary files from the server’s file system rather than only allowed image assets.

Path traversal vulnerability in EventReport for site-admin


Teemu Hakkarainen of Second Nature Security

The “Galaxy element JSON view", a functionality that renders JSON representations of “galaxy elements”, contained a cross-site scripting (XSS) vulnerability.

The issue could allow a malicious user (with the ability to influence galaxy element data) to inject JavaScript payloads that would execute in the browser of another user viewing the JSON view.

cross-site scripting (XSS) in Galaxy element JSON view


In MISP, the “REST client” interface that allows viewing data returned by modules suffered from a cross-site scripting (XSS) vulnerability when presenting “HTML view” of arbitrary JSON data. Prior to commit d718c026d5d69a50e3bbd51847a05ad8f386ec6c, the application did not sufficiently validate or restrict the type of response before offering to render it as HTML, allowing malicious JSON responses to be rendered in HTML context. This could allow an attacker (via a compromised or malicious module) to supply JSON containing content that, when interpreted as HTML, executes as script in the user’s browser.

XSS in MISP ReST client in HTML view


download_attachments_on_load is set to true by default, but setting this to false introduces a potential security risk. Clarified this in the setting

Clarified setting's impact on download_attachments_on_load


MISP contained a cross-site scripting (XSS) vulnerability in the Server Comparison tool. Prior to commit 83cc0b50971798bbf4be674e9ba744a8e874233a, certain fields displayed in the comparison view were not properly sanitized before being inserted into the HTML output. A malicious or compromised site-admin could inject crafted HTML/JavaScript payloads into comparison content, which would then execute in the browser of another site-admin viewing the Server Comparison interface.

XSS in MISP server comparison tool


MISP contained a reflected cross-site scripting (XSS) vulnerability in the showAttributeTag / tag selection UI.

cross-site scripting (XSS) vulnerability in the MISP showAttributeTag


MISP contained a reflected cross-site scripting (XSS) vulnerability in the Attribute Replacement Tool. Prior to commit f20e93e289998290946d56273528d2a4dc1c57fc, the event_id parameter was inserted into both the form action URL and an inline JavaScript handler without proper HTML-escaping. A malicious actor could craft a link with a specially crafted event_id value containing JavaScript, which would then be reflected back to the user and executed when the page was rendered.

Reflected cross-site scripting (XSS) vulnerability in the MISP Attribute Replacement Tool


MISP contained a reflected cross-site scripting (XSS) vulnerability in the Server Edit interface, specifically within the JavaScript initialization code of the push and pull filtering rule elements. Prior to commit b24e37a6c78199a4c68bb3b95f53d37962973d86, the id parameter (server ID) was embedded directly into a JavaScript string without HTML escaping. A maliciously crafted id value containing JavaScript or special characters could be reflected into the page and executed when an authenticated user visited the server edit page.

Reflected cross-site scripting (XSS) vulnerability in the Server Edit interface,


A reflected cross-site scripting (XSS) vulnerability was discovered in the server edit functionality of MISP. In serverRuleElements/pull.ctp and serverRuleElements/push.ctp, the id (server ID) value was written directly into an inline JavaScript variable (var serverID = "…"), without HTML escaping. A remote attacker could craft a URL with a malicious id value that, when visited by an authenticated user with access to the server edit interface, would result in arbitrary JavaScript execution in the victim’s browser.

Reflected cross-site scripting (XSS) vulnerability in the server edit functionality of MISP


MISP contained an information leakage vulnerability in the Feed configuration interface when tag collections were used and the “JSONified list” view was accessed. As a result, sensitive fields such as full user records, organisation metadata, or other internal attributes could be exposed to users who should not have had access to them when viewing the JSON output of feed configurations.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Information leakage vulnerability in the MISP Feed configuration interface


MISP contained two reflected cross-site scripting (XSS) vulnerabilities affecting:

EventGraph deletion confirmation form (eventGraph_delete_form.ctp)

Template file upload form (upload_file.ctp)

Before commit bd3ef20956e680fe12b3faf529efaaaee3e412dc, both templates used unvalidated numeric identifiers ($id and $element_id) directly in the rendered page. An attacker could craft a malicious request with a specially crafted non-numeric value for these parameters, causing untrusted data to be reflected into the HTML or JavaScript context of the forms—triggering arbitrary JavaScript execution in the browser of a logged-in user.

MISP contained two reflected cross-site scripting (XSS) vulnerabilities affecting:

  *
EventGraph deletion confirmation form (eventGraph_delete_form.ctp)

  *
Template file upload form (upload_file.ctp)

Before commit bd3ef20956e680fe12b3faf529efaaaee3e412dc, both templates used unvalidated numeric identifiers ($id and $element_id) directly in the rendered page. An attacker could craft a malicious request with a specially crafted non-numeric value for these parameters, causing untrusted data to be reflected into the HTML or JavaScript context of the forms—triggering arbitrary JavaScript execution in the browser of a logged-in user.

Reflected cross-site scripting (XSS) vulnerabilities in EventGraph and Template Upload


A cross-site scripting (XSS) vulnerability in the “actions” table element template in app/View/Elements/genericElements/IndexTable/Fields/actions.ctp allows an attacker to inject arbitrary JavaScript code into the generated HTML.

Successful exploitation allows execution of arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, data exfiltration, or UI redressing, depending on the permissions of the targeted user.

A cross-site scripting (XSS) vulnerability in the MISP “actions” table element template


A cross-site scripting (XSS) vulnerability was identified in the workflow execution-path view in app/View/Elements/Workflows/executionPath.ctp.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected application. Depending on the privileges of the targeted user, this may lead to session hijacking, workflow manipulation, data exfiltration, or impersonation within the application.

A cross-site scripting (XSS) vulnerability was identified in the MISP workflow execution-path view


The default
configuration of WatchGuard Firebox devices through 2025-09-10 allows
administrative access via SSH on port 4118 with the readwrite password
for the admin account.

GNA (CIRCL): We consider this being a vulnerability and confirm available exposed devices in our constituency.


In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the account to be locked or generating any specific alert for administrators.

This lack of rate-limiting and lockout on OTP failures significantly lowers the cost of online brute-force attacks against 2FA codes and increases the risk of successful account takeover, especially if OTP entropy is reduced (e.g. short numeric codes, user reuse, or predictable tokens). Additionally, administrators had no direct visibility into accounts experiencing repeated 2FA failures, making targeted attacks harder to detect and investigate.

The patch introduces a persistent failed_otp_attempts counter on user accounts, locks the user after 5 invalid OTP submissions, resets the counter on successful verification, and surfaces failed 2FA attempts in the admin user list. This enforces an account lockout policy for OTP brute-force attempts and improves monitoring capabilities for suspicious 2FA activity.

CWE-307 Improper Restriction of Excessive Authentication Attempts

Vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification.


Before the fix, some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged actions) may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site Request Forgery (CSRF) attacks: an attacker who tricks a logged-in user into visiting a malicious website could cause the user’s browser to issue GET requests that perform unintended state-changing operations in the context of their authenticated session.

Because the server would treat these GET requests as valid (since no CSRF protection or POST method enforcement was in place), the attacker could exploit this to escalate privileges, change settings, or carry out other unauthorized actions without needing the user’s explicit consent or awareness.

The fix ensures that all state-changing endpoints now require HTTP POST requests and include a valid CSRF token. This enforces that state changes cannot be triggered by arbitrary cross-site GET requests.

Missing CSRF protection on state-changing endpoints in Vulnerability-Lookup, potential cross-site request forgery (CSRF)


In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting (XSS).

On the backend, the related_vulnerabilities field of bundles accepted arbitrary strings without format validation or proper sanitization. On the frontend, comment and bundle descriptions were converted from Markdown to HTML and then injected directly into the DOM using string templates and innerHTML. This combination allowed an attacker who could create or edit comments or bundles to store crafted HTML/JavaScript payloads which would later be rendered and executed in the browser of any user visiting the affected profile page (user.html).

Insufficient sanitization of bundle metadata (available to admin only) and unsafe DOM construction allows stored XSS


A reflected cross-site scripting (XSS) vulnerability was identified in the Servers preview index view (app/View/Servers/preview_index.ctp). The view passes URL parameters directly into the onClickParams argument of the getPopup handler without proper HTML encoding.

Because $urlparams can be attacker-controlled, a specially crafted URL can inject arbitrary JavaScript into the generated page. When a site administrator follows such a malicious link and clicks the “Modify filters” button, the injected script is executed in their browser in the context of the application.

This issue has been fixed by ensuring that the URL parameters are HTML-escaped before being embedded.

A reflected cross-site scripting (XSS) vulnerability was identified in the MISp Servers preview index


A cross-site scripting (XSS) vulnerability was discovered in two dashboard widgets within the MISP application:

APIActivityWidget (app/Lib/Dashboard/APIActivityWidget.php)

LoginsWidget (app/Lib/Dashboard/LoginsWidget.php)

Both widgets construct HTML output using the instance’s base URL. While MISP.baseurl was properly HTML-escaped, the alternative configuration value MISP.external_baseurl was not escaped when read from configuration.

If an attacker with administrative privileges can set or influence the MISP.external_baseurl configuration value, they can inject arbitrary HTML or JavaScript, which will be rendered in the dashboard widgets of other site administrators. The issue was resolved by enforcing HTML escaping on the external base URL as well.

Because the affected widgets are only visible to administrators and the attack requires the attacker to already be a site administrator, the impact is limited. However, if exploited, an administrative user could inject JavaScript that executes in the browsers of other administrators viewing dashboard widgets, leading to:

Session hijacking within admin context (if cookies are accessible)

Execution of arbitrary actions as another site admin

Defacement or injection of misleading information into dashboards

This is considered low impact but with high exploitation requirements, as noted in the patch.

A cross-site scripting (XSS) vulnerability was discovered in two dashboard widgets within the MISP application:

  *
APIActivityWidget (app/Lib/Dashboard/APIActivityWidget.php)

  *
LoginsWidget (app/Lib/Dashboard/LoginsWidget.php)

Both widgets construct HTML output using the instance’s base URL. While MISP.baseurl was properly HTML-escaped, the alternative configuration value MISP.external_baseurl was not escaped when read from configuration.

If an attacker with administrative privileges can set or influence the MISP.external_baseurl configuration value, they can inject arbitrary HTML or JavaScript, which will be rendered in the dashboard widgets of other site administrators. The issue was resolved by enforcing HTML escaping on the external base URL as well.

Because the affected widgets are only visible to administrators and the attack requires the attacker to already be a site administrator, the impact is limited. However, if exploited, an administrative user could inject JavaScript that executes in the browsers of other administrators viewing dashboard widgets, leading to:

  *
Session hijacking within admin context (if cookies are accessible)

  *
Execution of arbitrary actions as another site admin

  *
Defacement or injection of misleading information into dashboards

This is considered low impact but with high exploitation requirements, as noted in the patch.

Reflected XSS in MISP Dashboard Widgets via Unescaped Base URL


A cross-site scripting (XSS) vulnerability was identified in two MISP views:

ajaxTemplateTag.ctp

Users/admin_index.ctp

1. ajaxTemplateTag.ctp

The JavaScript function call used for removing a template tag included both the tag ID and tag name.

Even though the tag name was escaped with h(), its placement inside a JavaScript string literal within an HTML attribute represents a fragile construction. Under specific conditions, crafted tag names containing special characters may break out of the JavaScript context, enabling XSS. The patch removes the unsafe second parameter:

By eliminating unnecessary exposure of user-controlled data to JavaScript, the potential XSS vector is removed.

2. Users/admin_index.ctp

The admin user list view passed unescaped filter parameters into the getPopup handler.

If $urlparams contained attacker-influenced content, a crafted URL could inject JavaScript that would execute when an administrator clicked “Modify filters.”

The vulnerabilities are classified as low impact and high difficulty, as noted in the patch. Exploitation requires:

The attacker to create or manipulate tag names or URL parameters in specific ways.

An administrator to interact with the affected UI elements (e.g., clicking “Remove tag” or “Modify filters”).

A cross-site scripting (XSS) vulnerability was identified in two MISP views:

  *
ajaxTemplateTag.ctp

  *
Users/admin_index.ctp

1. ajaxTemplateTag.ctp
The JavaScript function call used for removing a template tag included both the tag ID and tag name.

Even though the tag name was escaped with h(), its placement inside a JavaScript string literal within an HTML attribute represents a fragile construction. Under specific conditions, crafted tag names containing special characters may break out of the JavaScript context, enabling XSS. The patch removes the unsafe second parameter:

By eliminating unnecessary exposure of user-controlled data to JavaScript, the potential XSS vector is removed.

2. Users/admin_index.ctp

The admin user list view passed unescaped filter parameters into the getPopup handler.

If $urlparams contained attacker-influenced content, a crafted URL could inject JavaScript that would execute when an administrator clicked “Modify filters.”

The vulnerabilities are classified as low impact and high difficulty, as noted in the patch. Exploitation requires:

  *
The attacker to create or manipulate tag names or URL parameters in specific ways.

  *
An administrator to interact with the affected UI elements (e.g., clicking “Remove tag” or “Modify filters”).

Reflected XSS in MISP Template Tag Removal and MISP Admin User Filter Handling


A cross-site scripting (XSS) vulnerability was identified in the MISP dashboard subsystem, specifically in the World Map dashboard widget and the supporting JavaScript logic that handles widget configuration and rendering.

A prior XSS fix related to unsafe handling of widget configuration and tooltip rendering had been in place, but the upgrade to GridStack 1.2 unintentionally broke dashboard widget configuration persistence. When the patch restored correct widget config handling, the previously mitigated XSS vector became reachable again.

XSS Reintroduced in MISP Dashboard World Map Widget Due to Restored Widget Configuration Functionality


A cross-site scripting (XSS) vulnerability was identified in the event index table rendering logic related to organisation logos. The issue could allow attacker-controlled organisation names to be interpreted as executable HTML/JavaScript in a victim’s browser.

The vulnerability was caused by unsafe DOM manipulation in the onError handler of <img> elements used to display organisation logos in the event index view. When an organisation logo failed to load, the application replaced the image element using outerHTML, directly injecting the organisation name into the DOM. Under certain conditions, this could allow maliciously crafted organisation names to trigger XSS.

An authenticated attacker able to control organisation metadata (such as the organisation name) could potentially execute arbitrary JavaScript in the context of another user viewing the event index page. This may lead to session hijacking, UI manipulation, or other client-side attacks.


The vulnerability, in a series (5) of online services in Luxembourg, occurs because a request parameter (e.g., a search or query parameter) is incorporated directly into the server-generated HTML response without proper escaping. As a result, specially crafted input containing HTML tags and attributes can be interpreted by the browser as active markup rather than plain text.

An attacker can exploit this behavior by injecting HTML elements with JavaScript-capable event handlers. When the page is rendered and a user interacts with it (for example, through scrolling or other UI actions), the injected JavaScript executes within the security context of the vulnerable website.

This is a reflected XSS issue, meaning the malicious payload is not stored server-side but is immediately reflected in the HTTP response to a single request. Successful exploitation requires a victim to follow a malicious link or otherwise load a request crafted by the attacker.

Those vulnerabilities originated from a misconfiguration of the online service.
**exclusively-hosted-service**

CAPEC-244 XSS Targeting URI Placeholders

[online services] Reflected Cross-Site Scripting (XSS) / HTML Injection in Website Hosted in Luxembourg