concretecms-community-store

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

concretecms-community-store records in CISA KEV

No concretecms-community-store vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-63661 CVE-2026-95653 · GHSA-4m3m-829w-5q37

Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

MEDIUM 44

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00569 Published 2026-09-22 Fixed in 2.7.8 CWE-340

TI-2026-63091 CVE-2026-93659 · GHSA-9rr2-pvrh-g3pm

Concrete CMS Community Store before 2.7.8 Stored XSS

LOW 39

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00372 Published 2026-09-18 Fixed in 2.7.8 CWE-79

Open these records in search →

Critical	0
High	2
Medium	0
Low	0
No CVSS	0