Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
concretecms vulnerabilities and exploits
(subscribe to this query)
3.5
CVSSv2
CVE-2018-19146
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.
Concretecms Concrete Cms 8.4.3
4.3
CVSSv2
CVE-2017-8082
concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote malicious users to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. Thi...
Concretecms Concrete Cms 8.1.0
NA
CVE-2023-44761
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 up to and including 9.2.1 allow a local malicious user to execute arbitrary code via a crafted script to the Forms of the Data objects.
Concretecms Concrete Cms 9.2.1
NA
CVE-2023-44762
A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an malicious user to execute arbitrary code via a crafted script to the Tags from Settings - Tags.
Concretecms Concrete Cms 9.2.1
NA
CVE-2023-44763
Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file ty...
Concretecms Concrete Cms 9.2.1
NA
CVE-2023-44764
A Cross Site Scripting (XSS) vulnerability in Concrete CMS prior to 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).
Concretecms Concrete Cms 9.2.1
NA
CVE-2023-44760
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an malicious user to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer chang...
Concretecms Concrete Cms 9.2.1
NA
CVE-2023-44765
A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 up to and including 9.2.1 allows an malicious user to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.
Concretecms Concrete Cms 9.2.1
NA
CVE-2023-44766
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an malicious user to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, an...
Concretecms Concrete Cms 9.2.1
4.3
CVSSv2
CVE-2017-7725
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain nam...
Concretecms Concrete Cms 8.1.0
1 EDB exploit
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-52710
arbitrary
CVE-2024-5272
CVE-2024-2961
brute force
remote
CVE-2024-32944
CVE-2024-36241
CVE-2024-5274
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
3
4
5
6
7
8
9
NEXT »