Concrete CMS vulnerabilities
139 CVEs and advisories name Concrete CMS as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-81898Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views
- CVE-2026-81897Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control
- CVE-2026-81896Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label
- CVE-2026-18111Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification
- CVE-2026-81895Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`
- CVE-2026-81894Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field
- CVE-2026-18110Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
- CVE-2026-81900Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)
- CVE-2026-18116Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
- CVE-2026-18117Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
- CVE-2026-81901Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint
- CVE-2026-81902Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
- CVE-2026-81903Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon
- CVE-2026-18119Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
- CVE-2026-81907Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records
- CVE-2026-81918Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
- CVE-2026-81917Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
- CVE-2026-68535Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions
- CVE-2026-81916Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object
- CVE-2026-81915In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
- CVE-2026-68526Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
- CVE-2026-81913Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
- CVE-2026-81912Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
- CVE-2026-81911Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
- CVE-2026-81910Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values
- CVE-2026-81909Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks
- CVE-2026-68528Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title
- CVE-2026-18122Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization
- CVE-2026-81908Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups
- CVE-2026-81906[UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks