Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
concretecms vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2024-1246
Concrete CMS in version 9 prior to 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicio...
Concretecms Concrete Cms
NA
CVE-2024-1247
Concrete CMS version 9 prior to 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when ...
Concretecms Concrete Cms
NA
CVE-2023-28471
Concrete CMS (previously concrete5) in versions 9.0 up to and including 9.1.3 is vulnerable to Stored XSS via a container name.
Concretecms Concrete Cms
NA
CVE-2023-28472
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 up to and including 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.
Concretecms Concrete Cms
NA
CVE-2023-28473
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 up to and including 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
Concretecms Concrete Cms
NA
CVE-2023-28474
Concrete CMS (previously concrete5) in versions 9.0 up to and including 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
Concretecms Concrete Cms
NA
CVE-2023-28475
Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 up to and including 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
Concretecms Concrete Cms
NA
CVE-2023-28476
Concrete CMS (previously concrete5) in versions 9.0 up to and including 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.
Concretecms Concrete Cms
NA
CVE-2023-28477
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 up to and including 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.
Concretecms Concrete Cms
490
VMScore
CVE-2021-40109
A SSRF issue exists in Concrete CMS up to and including 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed a...
Concretecms Concrete Cms
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
inject
CVE-2024-34001
CVE-2024-37018
LFI
CVE-2024-1275
CVE-2024-1086
CSRF
CVE-2024-31030
CVE-2024-24919
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »