Skip to contentConcrete Cms vulnerabilities
Newest
- concrete cms cms, concretecms concrete cms +1 moreConcrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controllerCVE-2026-6826Fix available6.9 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below has Stored XSS on the height parameterCVE-2026-8203Fix available7.3 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration nameCVE-2026-8197Fix available7.3 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative GroupCVE-2026-8350Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCECVE-2026-8421Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreCSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and belowCVE-2026-8428Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwriteCVE-2026-8426Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controllerCVE-2026-8140Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controllerCVE-2026-8417Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.CVE-2026-8135Fix available8.9 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File InclusionCVE-2026-8134Fix available9.4 Critical
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist GroupCVE-2026-2994Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy formCVE-2026-3240Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.CVE-2026-3241Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language blockCVE-2026-3242Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page NamesCVE-2026-3244Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.CVE-2026-3452Fix available8.9 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard PageCVE-2025-8571Public exploitFix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard pageCVE-2025-8573Public exploitFix available2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attributeCVE-2025-3153Fix available5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreStored XSS in Folder Function by Rogue AdminCVE-2025-0660Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS Stored XSS Vulnerability in Calendar Event Addition FeatureCVE-2024-7398Fix available4.6 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS Stored XSS in Image Editor Background ColorCVE-2024-8291Fix available5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreStored XSS in the "Top Navigator Bar" blockCVE-2024-8660Fix available4.6 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" blockCVE-2024-8661Fix available4.6 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS DisplayerCVE-2024-4350Fix available5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS Stored XSS in Board instancesCVE-2024-7512Fix available4.6 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName()CVE-2024-7394Fix available4.6 Medium
- concrete cms cms, concretecms concrete cms +1 moreStored XSS in Generate Board Name Input FieldCVE-2024-43534.6 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field.CVE-2024-3181Fix available3.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type fileCVE-2024-3180Fix available3.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class pageCVE-2024-3179Fix available3.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search FilterCVE-2024-3178Fix available3.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screenCVE-2024-2753Fix available2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group typeCVE-2024-2179Fix available2.2 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributesCVE-2024-1245Fix available2.4 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import FeatureCVE-2024-1246Fix available2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name fieldCVE-2024-1247Public exploitFix available2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreA Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1...CVE-2011-31836.1 Medium