Concretecms-Community-Store Community Store
2 CVEs affecting Concretecms-Community-Store Community Store. Latest disclosed: 2026-09-22. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93659 | High | 8.1 | 2026-09-18 | Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers c… |
CVE-2026-95653 | High | 7.5 | 2026-09-22 | Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predic… |