Concretecms

concretecms

198 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Concrete Cms

concrete_cms

198 CVEs

CVEs (198)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-48652 1Concretecms 1Concrete Cms Jun 17, 2026 Dec 25, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to whic...Show more Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.Show less
CVE-2023-48649 1Concretecms 1Concrete Cms Jun 17, 2026 Nov 17, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.
CVE-2023-48648 1Concretecms 1Concrete Cms Jun 17, 2026 Nov 17, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777...Show more Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.Show less
CVE-2023-44760 1Concretecms 1Concrete Cms Jun 17, 2026 Oct 23, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vend...Show more Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly.Show less
CVE-2023-44763 1Concretecms 1Concrete Cms Jun 17, 2026 Oct 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf...Show more Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.Show less
CVE-2023-44766 1Concretecms 1Concrete Cms Jun 17, 2026 Oct 6, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-...Show more A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.Show less
CVE-2023-44765 1Concretecms 1Concrete Cms Jun 17, 2026 Oct 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from Syst...Show more A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.Show less
CVE-2023-44764 1Concretecms 1Concrete Cms Jun 17, 2026 Oct 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).
CVE-2023-44762 1Concretecms 1Concrete Cms Jun 17, 2026 Oct 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.
CVE-2023-44761 1Concretecms 1Concrete Cms Jun 17, 2026 Oct 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the...Show more Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.Show less
CVE-2023-28821 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
CVE-2023-28820 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
CVE-2023-28819 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
CVE-2023-28477 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.
CVE-2023-28476 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.
CVE-2023-28475 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
CVE-2023-28474 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
CVE-2023-28473 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 3.3 LOW· v3 N/A· v2 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
CVE-2023-28472 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.
CVE-2023-28471 1Concretecms 1Concrete Cms Jun 17, 2026 Apr 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.

Previous 1...678 9 10 Next