Concrete Cms
Page 2 of 2 — Concrete Cms CVEs from a corpus of 139, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8421 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. A… |
CVE-2026-8417 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() metho… |
CVE-2026-8350 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Gr… |
CVE-2026-8205 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which r… |
CVE-2026-8204 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A publ… |
CVE-2026-8203 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can… |
CVE-2026-8197 | Medium | 4.8 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlle… |
CVE-2026-8140 | Medium | 6.5 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method… |
CVE-2026-8135 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rog… |
CVE-2026-8134 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type compose… |
CVE-2026-6826 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated… |
CVE-2026-3242 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerab… |
CVE-2026-3241 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permission… |
CVE-2026-3240 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege acco… |
CVE-2026-2994 | Medium | 6.8 | 2026-03-04 | Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can… |
CVE-2026-3452 | High | 7.2 | 2026-03-04 | Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parame… |
CVE-2026-3244 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered wit… |
CVE-2025-8573 | Medium | 4.8 | 2025-08-05 | Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could… |
CVE-2025-8571 | Medium | 4.8 | 2025-08-05 | Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitiz… |
CVE-2025-3153 | Medium | 6.5 | 2025-04-03 | Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not… |
CVE-2025-0660 | Medium | 4.8 | 2025-03-10 | Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a r… |
CVE-2024-8291 | Medium | 4.8 | 2024-09-25 | Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to… |
CVE-2024-7398 | Medium | 5.4 | 2024-09-25 | Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event… |
CVE-2024-8660 | Medium | 4.8 | 2024-09-17 | Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was… |
CVE-2024-8661 | Medium | 4.8 | 2024-09-16 | Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a maliciou… |
CVE-2024-7512 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The… |
CVE-2024-4350 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses… |
CVE-2024-7394 | Medium | 4.8 | 2024-08-08 | Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious cod… |
CVE-2024-4353 | Medium | 4.8 | 2024-08-01 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input fie… |
CVE-2024-3181 | Low | 3.1 | 2024-04-03 | Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS coul… |
CVE-2024-3180 | Low | 3.1 | 2024-04-03 | Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue… |
CVE-2024-3179 | Low | 3.1 | 2024-04-03 | Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogu… |
CVE-2024-3178 | Low | 3.1 | 2024-04-03 | Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix… |
CVE-2024-2753 | Low | 2.0 | 2024-04-03 | Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information i… |
CVE-2024-2179 | Low | 2.2 | 2024-03-05 | Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator prov… |
CVE-2024-1246 | Low | 2.0 | 2024-02-09 | Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided… |
CVE-2024-1245 | Low | 2.4 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not suf… |
CVE-2024-1247 | Low | 2.0 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data… |
CVE-2011-3183 | Medium | 6.1 | 2020-01-14 | A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier. |