- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9
- Registry
- Packagist
Advisories 9
- CVE-2022-30120Unrated
XSS in /dashboard/blocks/stacks/view_details/ - old browsers only.
Affected: from 9.0.0, fixed in 9.1.0; fixed in 8.5.8.
- CVE-2022-21829Unrated
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which…
Affected: from 9.0.0, fixed in 9.1.0; fixed in 8.5.8.
- CVE-2022-30117Unrated
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in…
Affected: from 9.0.0, fixed in 9.1.0; fixed in 8.5.8.
- CVE-2021-22968Unrated
A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS…
Affected: fixed in 8.5.7.
- CVE-2021-22967Unrated
In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message…
Affected: fixed in 8.5.7.
- CVE-2021-22951Unrated
Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version…
Affected: fixed in 8.5.7.
- CVE-2021-22966Unrated
Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below.
Affected: fixed in 8.5.7.
- CVE-2021-22970Unrated
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable…
Affected: fixed in 8.5.7.
- CVE-2021-22969Unrated
Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability…
Affected: fixed in 8.5.7.