Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
concretecms vulnerabilities and exploits
(subscribe to this query)
5.4
CVSSv3
CVE-2021-28145
Concrete CMS (formerly concrete5) prior to 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
Concretecms Concrete Cms
9.8
CVSSv3
CVE-2023-48648
Concrete CMS prior to 8.5.13 and 9.x prior to 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions c...
Concretecms Concrete Cms
6.1
CVSSv3
CVE-2011-3183
A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and previous versions.
Concretecms Concrete Cms
4.8
CVSSv3
CVE-2024-1246
Concrete CMS in version 9 prior to 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicio...
Concretecms Concrete Cms
6.1
CVSSv3
CVE-2022-43967
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Concretecms Concrete Cms
6.1
CVSSv3
CVE-2022-43968
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Concretecms Concrete Cms
7.2
CVSSv3
CVE-2021-40099
An issue exists in Concrete CMS up to and including 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution.
Concretecms Concrete Cms
7.2
CVSSv3
CVE-2021-40101
An issue exists in Concrete CMS prior to 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password.
Concretecms Concrete Cms
9.1
CVSSv3
CVE-2021-40102
An issue exists in Concrete CMS up to and including 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated with the __wakeup magic method).
Concretecms Concrete Cms
7.5
CVSSv3
CVE-2021-40103
An issue exists in Concrete CMS up to and including 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF.
Concretecms Concrete Cms
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
man-in-the-middle
CVE-2024-34558
CVE-2024-32674
CVE-2024-34351
XPath injection
CVE-2023-45866
CVE-2024-25528
CVE-2024-25517
path traversal
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »