Skip to contentConcrete Cms vulnerabilities
Newest
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controllerCVE-2026-685265.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.CVE-2026-819135.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups featureCVE-2026-819125.7 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary DescriptionCVE-2026-819115.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style ValuesCVE-2026-819105.9 Medium
- concrete cms cmsConcrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocksCVE-2026-819095.9 Medium
- concrete cms cmsConcrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item titleCVE-2026-685286.0 Medium
- concrete cms cmsConcrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing AuthorizationCVE-2026-181226.0 Medium
- concrete cms cmsMissing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All GroupsCVE-2026-819086.0 Medium
- concrete cms cms[UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account ChecksCVE-2026-819066.3 Medium
- concrete cms cmsConcrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.CVE-2026-819056.3 Medium
- concrete cms cmsConcrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).CVE-2026-181216.3 Medium
- concrete cms cmsConcrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controllerCVE-2026-844325.3 Medium
- concrete cms cmsConcrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialogCVE-2026-685275.9 Medium
- concrete cms cmsConcrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset RegistrationCVE-2026-819046.3 Medium
- concrete cms cmsConcrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search componentsCVE-2026-10721Fix available8.4 High
- concrete cms cmsConcrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.CVE-2026-7888Fix available8.4 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik themeCVE-2026-8353Fix available2.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialogCVE-2026-8347Public exploitFix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersionCVE-2026-8340Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvNameCVE-2026-8139Fix available2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer BlockCVE-2026-7890Fix available2.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/deleteCVE-2026-8409Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/deleteCVE-2026-8410Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/deleteCVE-2026-8411Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cacheCVE-2026-8412Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/designCVE-2026-8413Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicateCVE-2026-8414Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorderCVE-2026-8415Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)CVE-2026-8416Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)CVE-2026-8427Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()CVE-2026-8432Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()CVE-2026-8433Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()CVE-2026-8434Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()CVE-2026-8435Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreFor Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account StatusCVE-2026-7887Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameterCVE-2026-7886Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controllerCVE-2026-7882Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.CVE-2026-8327Fix available5.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injectionCVE-2026-8245Fix available6.0 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveysCVE-2026-8337Public exploitFix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplateCVE-2026-8240Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail blockCVE-2026-7881Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()CVE-2026-7879Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation messageCVE-2026-8238Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpointCVE-2026-8237Public exploitFix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'CVE-2026-8239Public exploitFix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}CVE-2026-8236Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendarCVE-2026-8205Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend DialogCVE-2026-8204Fix available6.3 Medium
- Show moreLoading…