# cve.now: Concrete CMS

The newest entries naming Concrete CMS as an affected vendor (up to 200), of 139 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-18120](https://cve.now/CVE-2026-18120.md): Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data (CVSS 6.3)
- [CVE-2026-85387](https://cve.now/CVE-2026-85387.md): Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access (CVSS 2.0)
- [CVE-2026-87031](https://cve.now/CVE-2026-87031.md): Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation (CVSS 2.1)
- [CVE-2026-87028](https://cve.now/CVE-2026-87028.md): Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields (CVSS 5.3)
- [CVE-2026-85386](https://cve.now/CVE-2026-85386.md): Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block (CVSS 7.3)
- [CVE-2026-85385](https://cve.now/CVE-2026-85385.md): Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field (CVSS 7.7)
- [CVE-2026-81927](https://cve.now/CVE-2026-81927.md): Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode (CVSS 1.8)
- [CVE-2026-18426](https://cve.now/CVE-2026-18426.md): Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit (CVSS 2.0)
- [CVE-2026-81926](https://cve.now/CVE-2026-81926.md): Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog (CVSS 2.0)
- [CVE-2026-81925](https://cve.now/CVE-2026-81925.md): Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format (CVSS 2.1)
- [CVE-2026-18425](https://cve.now/CVE-2026-18425.md): IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages (CVSS 2.1)
- [CVE-2026-18424](https://cve.now/CVE-2026-18424.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports (CVSS 2.1)
- [CVE-2026-18423](https://cve.now/CVE-2026-18423.md): Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres (CVSS 2.1)
- [CVE-2026-18422](https://cve.now/CVE-2026-18422.md): Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation (CVSS 2.1)
- [CVE-2026-18421](https://cve.now/CVE-2026-18421.md): Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control (CVSS 2.1)
- [CVE-2026-68529](https://cve.now/CVE-2026-68529.md): Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries (CVSS 2.1)
- [CVE-2026-68530](https://cve.now/CVE-2026-68530.md): Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances (CVSS 2.1)
- [CVE-2026-68531](https://cve.now/CVE-2026-68531.md): Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search (CVSS 2.1)
- [CVE-2026-81924](https://cve.now/CVE-2026-81924.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation (CVSS 2.1)
- [CVE-2026-81923](https://cve.now/CVE-2026-81923.md): Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor (CVSS 2.1)
- [CVE-2026-81922](https://cve.now/CVE-2026-81922.md): "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages " (CVSS 2.1)
- [CVE-2026-81921](https://cve.now/CVE-2026-81921.md): In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status (CVSS 2.3)
- [CVE-2026-81920](https://cve.now/CVE-2026-81920.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint (CVSS 2.3)
- [CVE-2026-68532](https://cve.now/CVE-2026-68532.md): Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action (CVSS 2.3)
- [CVE-2026-68533](https://cve.now/CVE-2026-68533.md): Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission (CVSS 2.3)
- [CVE-2026-68534](https://cve.now/CVE-2026-68534.md): Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors (CVSS 2.3)
- [CVE-2026-81919](https://cve.now/CVE-2026-81919.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint (CVSS 2.3)
- [CVE-2026-81899](https://cve.now/CVE-2026-81899.md): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members \> Groups dashboard (CVSS 7.3)
- [CVE-2026-18115](https://cve.now/CVE-2026-18115.md): In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change\_password Enables Account Takeover. (CVSS 7.4)
- [CVE-2026-18113](https://cve.now/CVE-2026-18113.md): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names (CVSS 7.5)
- [CVE-2026-81898](https://cve.now/CVE-2026-81898.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views (CVSS 7.5)
- [CVE-2026-81897](https://cve.now/CVE-2026-81897.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save\_control (CVSS 7.7)
- [CVE-2026-81896](https://cve.now/CVE-2026-81896.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label (CVSS 8.4)
- [CVE-2026-18111](https://cve.now/CVE-2026-18111.md): Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification (CVSS 8.5)
- [CVE-2026-81895](https://cve.now/CVE-2026-81895.md): Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via \`fsID\[\]\` in \`setMode=any\` (CVSS 8.5)
- [CVE-2026-81894](https://cve.now/CVE-2026-81894.md): Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field (CVSS 8.5)
- [CVE-2026-18110](https://cve.now/CVE-2026-18110.md): Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username (CVSS 8.7)
- [CVE-2026-81900](https://cve.now/CVE-2026-81900.md): Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight) (CVSS 7.3)
- [CVE-2026-18116](https://cve.now/CVE-2026-18116.md): Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications (CVSS 7.3)
- [CVE-2026-18117](https://cve.now/CVE-2026-18117.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name (CVSS 7.3)
- [CVE-2026-81901](https://cve.now/CVE-2026-81901.md): Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the \`PUT /pages/{cID}\` endpoint (CVSS 7.2)
- [CVE-2026-81902](https://cve.now/CVE-2026-81902.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup (CVSS 7.1)
- [CVE-2026-81903](https://cve.now/CVE-2026-81903.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon (CVSS 7.0)
- [CVE-2026-18119](https://cve.now/CVE-2026-18119.md): Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values (CVSS 7.0)
- [CVE-2026-81907](https://cve.now/CVE-2026-81907.md): Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete\_entries allowing mass deletion of all entity records (CVSS 6.1)
- [CVE-2026-81918](https://cve.now/CVE-2026-81918.md): Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block (CVSS 4.8)
- [CVE-2026-81917](https://cve.now/CVE-2026-81917.md): Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags (CVSS 5.1)
- [CVE-2026-68535](https://cve.now/CVE-2026-68535.md): Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions (CVSS 5.1)
- [CVE-2026-81916](https://cve.now/CVE-2026-81916.md): Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object (CVSS 5.1)
- [CVE-2026-81915](https://cve.now/CVE-2026-81915.md): In Concrete CMS below 9.5.3, Page Type update omits object-level authorization (CVSS 5.1)
- [CVE-2026-68526](https://cve.now/CVE-2026-68526.md): Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller (CVSS 5.3)
- [CVE-2026-81913](https://cve.now/CVE-2026-81913.md): Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. (CVSS 5.3)
- [CVE-2026-81912](https://cve.now/CVE-2026-81912.md): Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature (CVSS 5.7)
- [CVE-2026-81911](https://cve.now/CVE-2026-81911.md): Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save\_template via Unescaped Summary Description (CVSS 5.8)
- [CVE-2026-81910](https://cve.now/CVE-2026-81910.md): Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values (CVSS 5.9)
- [CVE-2026-81909](https://cve.now/CVE-2026-81909.md): Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks (CVSS 5.9)
- [CVE-2026-68528](https://cve.now/CVE-2026-68528.md): Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title (CVSS 6.0)
- [CVE-2026-18122](https://cve.now/CVE-2026-18122.md): Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization (CVSS 6.0)
- [CVE-2026-81908](https://cve.now/CVE-2026-81908.md): Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups (CVSS 6.0)
- [CVE-2026-81906](https://cve.now/CVE-2026-81906.md): \[UNREVIEWED\] OAuth Callback Login Bypasses Deactivated-Account Checks (CVSS 6.3)
- [CVE-2026-81905](https://cve.now/CVE-2026-81905.md): Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another. (CVSS 6.3)
- [CVE-2026-18121](https://cve.now/CVE-2026-18121.md): Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view\_event/{bID}/{occurrence\_id}). (CVSS 6.3)
- [CVE-2026-84432](https://cve.now/CVE-2026-84432.md): Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller (CVSS 5.3)
- [CVE-2026-68527](https://cve.now/CVE-2026-68527.md): Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog (CVSS 5.9)
- [CVE-2026-81904](https://cve.now/CVE-2026-81904.md): Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration (CVSS 6.3)
- [CVE-2026-10721](https://cve.now/CVE-2026-10721.md): Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components (CVSS 8.4)
- [CVE-2026-7888](https://cve.now/CVE-2026-7888.md): Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed\_classes restriction. (CVSS 8.4)
- [CVE-2026-8353](https://cve.now/CVE-2026-8353.md): Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme (CVSS 2.1)
- [CVE-2026-8347](https://cve.now/CVE-2026-8347.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog (CVSS 2.3)
- [CVE-2026-8340](https://cve.now/CVE-2026-8340.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\\File::approveVersion (CVSS 2.3)
- [CVE-2026-8139](https://cve.now/CVE-2026-8139.md): Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName (CVSS 2.0)
- [CVE-2026-7890](https://cve.now/CVE-2026-7890.md): Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block (CVSS 2.1)
- [CVE-2026-8409](https://cve.now/CVE-2026-8409.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete (CVSS 2.3)
- [CVE-2026-8410](https://cve.now/CVE-2026-8410.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete (CVSS 2.3)
- [CVE-2026-8411](https://cve.now/CVE-2026-8411.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete (CVSS 2.3)
- [CVE-2026-8412](https://cve.now/CVE-2026-8412.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache (CVSS 2.3)
- [CVE-2026-8413](https://cve.now/CVE-2026-8413.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design (CVSS 2.3)
- [CVE-2026-8414](https://cve.now/CVE-2026-8414.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate (CVSS 2.3)
- [CVE-2026-8415](https://cve.now/CVE-2026-8415.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder (CVSS 2.3)
- [CVE-2026-8416](https://cve.now/CVE-2026-8416.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) (CVSS 2.3)
- [CVE-2026-8427](https://cve.now/CVE-2026-8427.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) (CVSS 2.3)
- [CVE-2026-8432](https://cve.now/CVE-2026-8432.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() (CVSS 2.3)
- [CVE-2026-8433](https://cve.now/CVE-2026-8433.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() (CVSS 2.3)
- [CVE-2026-8434](https://cve.now/CVE-2026-8434.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() (CVSS 2.3)
- [CVE-2026-8435](https://cve.now/CVE-2026-8435.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() (CVSS 2.3)
- [CVE-2026-7887](https://cve.now/CVE-2026-7887.md): For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status (CVSS 2.3)
- [CVE-2026-7886](https://cve.now/CVE-2026-7886.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments\[\] parameter (CVSS 2.3)
- [CVE-2026-7882](https://cve.now/CVE-2026-7882.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller (CVSS 2.3)
- [CVE-2026-8327](https://cve.now/CVE-2026-8327.md): Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. (CVSS 5.3)
- [CVE-2026-8245](https://cve.now/CVE-2026-8245.md): Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection (CVSS 6.0)
- [CVE-2026-8337](https://cve.now/CVE-2026-8337.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys (CVSS 6.3)
- [CVE-2026-8240](https://cve.now/CVE-2026-8240.md): Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\\SummaryTemplate (CVSS 6.3)
- [CVE-2026-7881](https://cve.now/CVE-2026-7881.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block (CVSS 6.3)
- [CVE-2026-7879](https://cve.now/CVE-2026-7879.md): Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit\_password() (CVSS 6.3)
- [CVE-2026-8238](https://cve.now/CVE-2026-8238.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message\_page' allowing unauthenticated read of any conversation message (CVSS 6.3)
- [CVE-2026-8237](https://cve.now/CVE-2026-8237.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in the\`/ccm/frontend/conversations/message\_detail\` endpoint (CVSS 6.3)
- [CVE-2026-8239](https://cve.now/CVE-2026-8239.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get\_rating' (CVSS 6.3)
- [CVE-2026-8236](https://cve.now/CVE-2026-8236.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID} (CVSS 6.3)
- [CVE-2026-8205](https://cve.now/CVE-2026-8205.md): Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action\_get\_events does not check canView on the calendar (CVSS 6.3)
- [CVE-2026-8204](https://cve.now/CVE-2026-8204.md): Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog (CVSS 6.3)
- [CVE-2026-6826](https://cve.now/CVE-2026-6826.md): Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller (CVSS 6.9)
- [CVE-2026-8203](https://cve.now/CVE-2026-8203.md): Concrete CMS 9.5.0 and below has Stored XSS on the height parameter (CVSS 7.3)
- [CVE-2026-8197](https://cve.now/CVE-2026-8197.md): Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name (CVSS 7.3)
- [CVE-2026-8350](https://cve.now/CVE-2026-8350.md): Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk\_user\_assignment.php which can lead to privilege escalation to Administrative Group (CVSS 7.5)
- [CVE-2026-8421](https://cve.now/CVE-2026-8421.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF on install\_package() with conditional token bypass leading to RCE (CVSS 7.5)
- [CVE-2026-8428](https://cve.now/CVE-2026-8428.md): CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below (CVSS 7.5)
- [CVE-2026-8426](https://cve.now/CVE-2026-8426.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare\_remote\_upgrade() leading to one-request RCE via package overwrite (CVSS 7.5)
- [CVE-2026-8140](https://cve.now/CVE-2026-8140.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller (CVSS 7.5)
- [CVE-2026-8417](https://cve.now/CVE-2026-8417.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF in do\_update() in the package update controller (CVSS 7.5)
- [CVE-2026-8135](https://cve.now/CVE-2026-8135.md): Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller. (CVSS 8.9)
- [CVE-2026-8134](https://cve.now/CVE-2026-8134.md): Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion (CVSS 9.4)
- [CVE-2026-2994](https://cve.now/CVE-2026-2994.md): Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group (CVSS 2.3)
- [CVE-2026-3240](https://cve.now/CVE-2026-3240.md): Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form (CVSS 4.8)
- [CVE-2026-3241](https://cve.now/CVE-2026-3241.md): Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block. (CVSS 4.8)
- [CVE-2026-3242](https://cve.now/CVE-2026-3242.md): Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block (CVSS 4.8)
- [CVE-2026-3244](https://cve.now/CVE-2026-3244.md): Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names (CVSS 4.8)
- [CVE-2026-3452](https://cve.now/CVE-2026-3452.md): Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block. (CVSS 8.9)
- [CVE-2025-8571](https://cve.now/CVE-2025-8571.md): Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page (CVSS 4.8)
- [CVE-2025-8573](https://cve.now/CVE-2025-8573.md): Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page (CVSS 2.0)
- [CVE-2025-3153](https://cve.now/CVE-2025-3153.md): Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute (CVSS 5.1)
- [CVE-2025-0660](https://cve.now/CVE-2025-0660.md): Stored XSS in Folder Function by Rogue Admin (CVSS 4.8)
- [CVE-2024-7398](https://cve.now/CVE-2024-7398.md): Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature (CVSS 4.6)
- [CVE-2024-8291](https://cve.now/CVE-2024-8291.md): Concrete CMS Stored XSS in Image Editor Background Color (CVSS 5.1)
- [CVE-2024-8660](https://cve.now/CVE-2024-8660.md): Stored XSS in the "Top Navigator Bar" block (CVSS 4.6)
- [CVE-2024-8661](https://cve.now/CVE-2024-8661.md): Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block (CVSS 4.6)
- [CVE-2024-4350](https://cve.now/CVE-2024-4350.md): Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer (CVSS 5.1)
- [CVE-2024-7512](https://cve.now/CVE-2024-7512.md): Concrete CMS Stored XSS in Board instances (CVSS 4.6)
- [CVE-2024-7394](https://cve.now/CVE-2024-7394.md): Concrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName() (CVSS 4.6)
- [CVE-2024-4353](https://cve.now/CVE-2024-4353.md): Stored XSS in Generate Board Name Input Field (CVSS 4.6)
- [CVE-2024-3181](https://cve.now/CVE-2024-3181.md): Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. (CVSS 3.1)
- [CVE-2024-3180](https://cve.now/CVE-2024-3180.md): Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file (CVSS 3.1)
- [CVE-2024-3179](https://cve.now/CVE-2024-3179.md): Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page (CVSS 3.1)
- [CVE-2024-3178](https://cve.now/CVE-2024-3178.md): Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter (CVSS 3.1)
- [CVE-2024-2753](https://cve.now/CVE-2024-2753.md): Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen (CVSS 2.0)
- [CVE-2024-2179](https://cve.now/CVE-2024-2179.md): Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type (CVSS 2.2)
- [CVE-2024-1245](https://cve.now/CVE-2024-1245.md): Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes (CVSS 2.4)
- [CVE-2024-1246](https://cve.now/CVE-2024-1246.md): Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature (CVSS 2.0)
- [CVE-2024-1247](https://cve.now/CVE-2024-1247.md): Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field (CVSS 2.0)
- [CVE-2011-3183](https://cve.now/CVE-2011-3183.md): A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/concrete-cms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.