Concrete CMS vulnerabilities
139 CVEs and advisories name Concrete CMS as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-0660Stored XSS in Folder Function by Rogue Admin
- CVE-2024-7398Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature
- CVE-2024-8291Concrete CMS Stored XSS in Image Editor Background Color
- CVE-2024-8660Stored XSS in the "Top Navigator Bar" block
- CVE-2024-8661Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block
- CVE-2024-4350Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer
- CVE-2024-7512Concrete CMS Stored XSS in Board instances
- CVE-2024-7394Concrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName()
- CVE-2024-4353Stored XSS in Generate Board Name Input Field
- CVE-2024-3181Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field.
- CVE-2024-3180Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file
- CVE-2024-3179Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page
- CVE-2024-3178Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter
- CVE-2024-2753Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen
- CVE-2024-2179Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type
- CVE-2024-1245Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes
- CVE-2024-1246Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature
- CVE-2024-1247Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
- CVE-2011-3183A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.