Concretecms Concrete Cms vulnerabilities

CVE-2021-22953 [MEDIUM] CWE-352 CVE-2021-22953: A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"

CVE-2022-43694 [MEDIUM] CWE-79 CVE-2022-43694: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflecte Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.

CVE-2020-14961 [MEDIUM] CVE-2020-14961: Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value. Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.

CVE-2023-44762 [MEDIUM] CWE-79 CVE-2023-44762: A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an at A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

CVE-2023-44764 [MEDIUM] CWE-79 CVE-2023-44764: A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name paramete A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).

CVE-2021-40100 [MEDIUM] CWE-79 CVE-2021-40100: An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when th An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text.

CVE-2023-28820 [MEDIUM] CWE-79 CVE-2023-28820: Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

CVE-2024-1247 [MEDIUM] CWE-20 CVE-2024-1247: Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 w

CVE-2026-7886 [MEDIUM] CWE-639 CVE-2026-7886: Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] par Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file attachment IDs and load files directly via `$em->find(File::class, $attachmentID)` without checking per-file permiss

CVE-2015-4721 [MEDIUM] CWE-79 CVE-2015-4721: Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1. Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1.

CVE-2011-3183 [MEDIUM] CWE-79 CVE-2011-3183: A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.

CVE-2024-7394 [MEDIUM] CWE-79 CVE-2024-7394: Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeS Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious code. The Concrete CMS team gave this a CVSS v4.0 rank of 4.6 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS:4.0/AV:N/AC:L/

CVE-2026-8197 [MEDIUM] CWE-79 CVE-2026-8197: Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth autho Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The ... wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output a

CVE-2026-8353 [MEDIUM] CWE-79 CVE-2026-8353: Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A r Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential pr

CVE-2026-7881 [MEDIUM] CWE-639 CVE-2026-7881: Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express En Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:

CVE-2026-8236 [MEDIUM] CWE-862 CVE-2026-8236: Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request. The Concrete CMS security team gave this vulnerability a CVSS

CVE-2026-8327 [MEDIUM] CWE-269 CVE-2026-8327: Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and sess Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to d

CVE-2023-49337 [MEDIUM] CWE-79 CVE-2023-49337: Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)

CVE-2024-8291 [MEDIUM] CWE-22 CVE-2024-8291: Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor B Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:

CVE-2024-4350 [MEDIUM] CWE-79 CVE-2024-4350: Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 5.1 with vector http