CVE-2026-8353 | Medium | 4.8 | 2026-05-22 | Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes i… |
CVE-2026-8347 | Medium | 4.3 | 2026-05-22 | Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state ta… |
CVE-2026-8340 | Medium | 4.3 | 2026-05-22 | Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd into publishing an att… |
CVE-2026-8435 | Medium | 6.5 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security… |
CVE-2026-8434 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security… |
CVE-2026-8433 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team ga… |
CVE-2026-8432 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave… |
CVE-2026-8427 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS… |
CVE-2026-8416 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS se… |
CVE-2026-8415 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS sec… |
CVE-2026-8414 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team g… |
CVE-2026-8413 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team… |
CVE-2026-8412 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team… |
CVE-2026-8411 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team… |
CVE-2026-8410 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. The The Concrete CMS security… |
CVE-2026-8409 | High | 8.8 | 2026-05-21 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. The The Concrete CMS security team… |
CVE-2026-8337 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private… |
CVE-2026-8327 | Medium | 4.3 | 2026-05-21 | Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller pass… |
CVE-2026-8245 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds paginatio… |
CVE-2026-8240 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the exis… |
CVE-2026-8239 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any m… |
CVE-2026-8238 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation messag… |
CVE-2026-8237 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation mess… |
CVE-2026-8236 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an in… |
CVE-2026-8139 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Conc… |
CVE-2026-7890 | Medium | 6.4 | 2026-05-21 | In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirec… |
CVE-2026-7887 | Medium | 6.4 | 2026-05-21 | For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee… |
CVE-2026-7886 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMe… |
CVE-2026-7882 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an… |
CVE-2026-7881 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR lea… |
CVE-2026-7879 | Medium | 5.3 | 2026-05-21 | In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since down… |
CVE-2026-8428 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method i… |
CVE-2026-8426 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An atta… |
CVE-2026-8421 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. A… |
CVE-2026-8417 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() metho… |
CVE-2026-8350 | High | 8.8 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Gr… |
CVE-2026-8205 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which r… |
CVE-2026-8204 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A publ… |
CVE-2026-8203 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can… |
CVE-2026-8197 | Medium | 4.8 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlle… |
CVE-2026-8140 | Medium | 6.5 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method… |
CVE-2026-8135 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rog… |
CVE-2026-8134 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type compose… |
CVE-2026-6826 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated… |
CVE-2026-30662 | Medium | 6.5 | 2026-03-24 | ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file… |
CVE-2026-3242 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerab… |
CVE-2026-3241 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permission… |
CVE-2026-3240 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege acco… |
CVE-2026-2994 | Medium | 6.8 | 2026-03-04 | Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can… |
CVE-2026-3452 | High | 7.2 | 2026-03-04 | Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parame… |
CVE-2026-3244 | Medium | 4.8 | 2026-03-04 | In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered wit… |
CVE-2025-8573 | Medium | 4.8 | 2025-08-05 | Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could… |
CVE-2025-8571 | Medium | 4.8 | 2025-08-05 | Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitiz… |
CVE-2025-3153 | Medium | 6.5 | 2025-04-03 | Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not… |
CVE-2025-0660 | Medium | 4.8 | 2025-03-10 | Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a r… |
CVE-2024-8291 | Medium | 4.8 | 2024-09-25 | Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to… |
CVE-2024-7398 | Medium | 5.4 | 2024-09-25 | Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event… |
CVE-2024-8660 | Medium | 4.8 | 2024-09-17 | Concrete CMS versions 9.0.0 through 9.3.3 are affected by a
stored XSS vulnerability in the "Top Navigator Bar" block.
Since the "Top Navigator Bar" output was… |
CVE-2024-8661 | Medium | 4.8 | 2024-09-16 | Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a maliciou… |
CVE-2024-7512 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The… |
CVE-2024-4350 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses… |
CVE-2024-7394 | Medium | 4.8 | 2024-08-08 | Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious cod… |
CVE-2024-4353 | Medium | 4.8 | 2024-08-01 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board
instance functionality. The Name input fie… |
CVE-2024-3181 | Low | 3.1 | 2024-04-03 | Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS coul… |
CVE-2024-3180 | Low | 3.1 | 2024-04-03 | Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue… |
CVE-2024-3179 | Low | 3.1 | 2024-04-03 | Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogu… |
CVE-2024-3178 | Low | 3.1 | 2024-04-03 | Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix… |
CVE-2024-2753 | Low | 2.0 | 2024-04-03 | Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information i… |
CVE-2024-2179 | Low | 2.2 | 2024-03-05 | Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator prov… |
CVE-2023-49337 | Low | 2.4 | 2024-02-29 | Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.) |
CVE-2023-48653 | Medium | 4.3 | 2024-02-29 | Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An attacker can force an a… |
CVE-2023-48651 | Medium | 4.3 | 2024-02-29 | Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit. |
CVE-2023-48650 | Medium | 4.8 | 2024-02-29 | Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name. |
CVE-2024-1246 | Low | 2.0 | 2024-02-09 | Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided… |
CVE-2024-1245 | Low | 2.4 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not suf… |
CVE-2024-1247 | Low | 2.0 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data… |
CVE-2023-48652 | Medium | 4.3 | 2023-12-25 | Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin u… |
CVE-2023-48649 | Low | 3.5 | 2023-11-17 | Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name. |
CVE-2023-48648 | Critical | 9.8 | 2023-11-17 | Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation function… |
CVE-2023-44760 | Medium | 4.8 | 2023-10-23 | Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and… |
CVE-2023-44763 | Medium | 5.4 | 2023-10-10 | Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendo… |
CVE-2023-44766 | Medium | 4.8 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Pa… |
CVE-2023-44765 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a… |
CVE-2023-44764 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings… |
CVE-2023-44762 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to th… |
CVE-2023-44761 | Medium | 5.4 | 2023-10-06 | Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to ex… |
CVE-2023-28821 | Medium | 5.3 | 2023-04-28 | Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets. |
CVE-2023-28820 | Low | 2.0 | 2023-04-28 | Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanit… |
CVE-2023-28819 | Low | 3.5 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names. |
CVE-2023-28477 | Medium | 5.5 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter. |
CVE-2023-28476 | Medium | 5.4 | 2023-04-28 | Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files. |
CVE-2023-28475 | Medium | 6.1 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID wa… |
CVE-2023-28474 | Medium | 5.4 | 2023-04-28 | Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search. |
CVE-2023-28473 | Low | 3.3 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section. |
CVE-2023-28472 | Medium | 5.3 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies. |
CVE-2023-28471 | Medium | 5.4 | 2023-04-28 | Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name. |
CVE-2022-43556 | Medium | 6.1 | 2022-12-05 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output… |
CVE-2022-43695 | Medium | 4.8 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entit… |
CVE-2022-43691 | Medium | 5.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment var… |
CVE-2022-43690 | Medium | 6.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication byp… |