Concrete5

9 CVEs across 2 Concrete5 products. Browse Concrete5 vulnerabilities, severities, and proof-of-concept exploits.

Concrete5 products with known CVEs

ProductCVEs
Concrete58
Concrete1
Concrete5 CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2017-6908Medium6.12017-03-15An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-l…
CVE-2017-6905Medium6.12017-03-15An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "…
CVE-2015-39892015-05-15Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related…
CVE-2015-22502015-05-15Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_…
CVE-2014-95262015-01-05Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via…
CVE-2014-51082014-07-28Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or…
CVE-2014-51072014-07-28concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) s…
CVE-2012-51812012-12-21Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inj…
CVE-2011-37212011-09-23concrete 5.4.0.5, 5.4.1, and 5.4.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installatio…