Skip to contentConcretecms vulnerabilities
Newest
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/deleteCVE-2026-8410Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/deleteCVE-2026-8411Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cacheCVE-2026-8412Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/designCVE-2026-8413Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicateCVE-2026-8414Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorderCVE-2026-8415Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)CVE-2026-8416Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)CVE-2026-8427Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()CVE-2026-8432Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()CVE-2026-8433Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()CVE-2026-8434Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()CVE-2026-8435Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreFor Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account StatusCVE-2026-7887Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameterCVE-2026-7886Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controllerCVE-2026-7882Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.CVE-2026-8327Fix available5.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injectionCVE-2026-8245Fix available6.0 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveysCVE-2026-8337Public exploitFix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplateCVE-2026-8240Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail blockCVE-2026-7881Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()CVE-2026-7879Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation messageCVE-2026-8238Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpointCVE-2026-8237Public exploitFix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'CVE-2026-8239Public exploitFix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}CVE-2026-8236Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendarCVE-2026-8205Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend DialogCVE-2026-8204Fix available6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controllerCVE-2026-6826Fix available6.9 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below has Stored XSS on the height parameterCVE-2026-8203Fix available7.3 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration nameCVE-2026-8197Fix available7.3 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative GroupCVE-2026-8350Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCECVE-2026-8421Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreCSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and belowCVE-2026-8428Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwriteCVE-2026-8426Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controllerCVE-2026-8140Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controllerCVE-2026-8417Fix available7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.CVE-2026-8135Fix available8.9 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File InclusionCVE-2026-8134Fix available9.4 Critical
- concretecms concrete cmsConcreteCMS is vulnerable to Denial of Service During Bulk DownloadsCVE-2026-306626.5 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist GroupCVE-2026-2994Fix available2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy formCVE-2026-3240Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.CVE-2026-3241Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language blockCVE-2026-3242Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page NamesCVE-2026-3244Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.CVE-2026-3452Fix available8.9 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard PageCVE-2025-8571Public exploitFix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard pageCVE-2025-8573Public exploitFix available2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attributeCVE-2025-3153Fix available5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreStored XSS in Folder Function by Rogue AdminCVE-2025-0660Fix available4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS Stored XSS Vulnerability in Calendar Event Addition FeatureCVE-2024-7398Fix available4.6 Medium
- Show moreLoading…