TI-2017-04634 CVE-2017-6908 · GHSA-rfgg-9xf9-95wg
An issue was discovered in concrete5 <= 5.6.3.4.
Priority LOW 30
An issue was discovered in concrete5 <= 5.6.3.4.
Concrete5
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Concrete5 records in CISA KEVNo Concrete5 vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records
TI-2017-04631 CVE-2017-6905 · GHSA-5v8q-gjmf-rmm4
An issue was discovered in concrete5 <= 5.6.3.4.
Priority LOW 29
An issue was discovered in concrete5 <= 5.6.3.4.
TI-2014-04178 CVE-2014-5107 · GHSA-m9jx-h2qw-h5qj
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a…
Priority LOW 28
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail…
TI-2011-03278 CVE-2011-3721 · GHSA-4qpv-jgvp-h49c
concrete 5.4.0.5, 5.4.1, and 5.4.1.1 allows remote attackers to obtain sensitive…
Priority LOW 26
concrete 5.4.0.5, 5.4.1, and 5.4.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/spellche…
TI-2015-01997 CVE-2015-2250 · GHSA-4386-3ggv-4ppc
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/…
TI-2014-07748 CVE-2014-9526 · GHSA-qvxc-3hm6-c42q
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/group…
TI-2014-04179 CVE-2014-5108 · GHSA-4269-gch5-8w3c
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.
TI-2012-04370 CVE-2012-5181 · GHSA-x4x9-4c65-73w8
Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
TI-2015-03372 CVE-2015-3989 · GHSA-jxhp-rwqv-9fjj
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow…
Priority LOW 22
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.