Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
concretecms concrete cms vulnerabilities and exploits
(subscribe to this query)
5.4
CVSSv3
CVE-2023-44764
A Cross Site Scripting (XSS) vulnerability in Concrete CMS prior to 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).
Concretecms Concrete Cms 9.2.1
5.4
CVSSv3
CVE-2023-44761
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 up to and including 9.2.1 allow a local malicious user to execute arbitrary code via a crafted script to the Forms of the Data objects.
Concretecms Concrete Cms 9.2.1
5.4
CVSSv3
CVE-2023-44762
A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an malicious user to execute arbitrary code via a crafted script to the Tags from Settings - Tags.
Concretecms Concrete Cms 9.2.1
5.3
CVSSv3
CVE-2023-28472
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 up to and including 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.
Concretecms Concrete Cms
6.1
CVSSv3
CVE-2023-28475
Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 up to and including 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
Concretecms Concrete Cms
5.4
CVSSv3
CVE-2023-28819
Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 up to and including 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
Concretecms Concrete Cms
5.3
CVSSv3
CVE-2023-28821
Concrete CMS (previously concrete5) prior to 9.1 did not have a rate limit for password resets.
Concretecms Concrete Cms
5.4
CVSSv3
CVE-2023-28471
Concrete CMS (previously concrete5) in versions 9.0 up to and including 9.1.3 is vulnerable to Stored XSS via a container name.
Concretecms Concrete Cms
3.3
CVSSv3
CVE-2023-28473
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 up to and including 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
Concretecms Concrete Cms
5.4
CVSSv3
CVE-2023-28474
Concrete CMS (previously concrete5) in versions 9.0 up to and including 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
Concretecms Concrete Cms
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
log injection
CVE-2024-37079
type confusion
CVE-2024-32943
CVE-2024-30103
CVE-2024-37350
arbitrary code
CVE-2024-6189
CVE-2024-6225
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »