Read the docs
TI-2012-04370 Aliases CVE-2012-5181GHSA-x4x9-4c65-73w8

Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and…

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Why it matters now

EPSS 0.0143 73rd percentileScored 2026-11-07
Fix Fixed concrete5/concrete5 (Packagist): 5.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—concrete5/concrete5 (Packagist)5.5.1 to before 5.6.15.6.1Patch availableGHSA-x4x9-4c65-73w8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • concrete5/concrete5 (Packagist) Vendor— Affected 5.5.1 to before 5.6.1 Fixed in 5.6.1 Patch available GHSA-x4x9-4c65-73w8

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:concrete5:concrete5:5.5.0:*:*:en:*:*:*:*5.5.0VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.5.1:*:*:en:*:*:*:*5.5.1VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.5.1:*:*:ja:*:*:*:*5.5.1VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.5.2:*:*:en:*:*:*:*5.5.2VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.5.2:*:*:ja:*:*:*:*5.5.2VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.5.2.1:*:*:en:*:*:*:*5.5.2.1VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.5.2.1:*:*:ja:*:*:*:*5.5.2.1VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.6.0:*:*:en:*:*:*:*5.6.0VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.6.0.1:*:*:en:*:*:*:*5.6.0.1VulnerableConcrete5
cpe:2.3:a:concrete5:concrete5:5.6.0.2:*:*:en:*:*:*:*5.6.0.2VulnerableConcrete5
  • cpe:2.3:a:concrete5:concrete5:5.5.0:*:*:en:*:*:*:* Versions 5.5.0 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.5.1:*:*:en:*:*:*:* Versions 5.5.1 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.5.1:*:*:ja:*:*:*:* Versions 5.5.1 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.5.2:*:*:en:*:*:*:* Versions 5.5.2 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.5.2:*:*:ja:*:*:*:* Versions 5.5.2 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.5.2.1:*:*:en:*:*:*:* Versions 5.5.2.1 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.5.2.1:*:*:ja:*:*:*:* Versions 5.5.2.1 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.6.0:*:*:en:*:*:*:* Versions 5.6.0 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.6.0.1:*:*:en:*:*:*:* Versions 5.6.0.1 Vulnerable ·Concrete5
  • cpe:2.3:a:concrete5:concrete5:5.6.0.2:*:*:en:*:*:*:* Versions 5.6.0.2 Vulnerable ·Concrete5

Remediation

  • Fix · GHSA-x4x9-4c65-73w8 concrete5/concrete5 (Packagist) Fixed in 5.6.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5181
  2. 2026-10-03 Alias added: GHSA-x4x9-4c65-73w8

References

Patch 1

Advisory 3

Other 2

  • TI-2017-04634 An issue was discovered in concrete5 <= 5.6.3.4. CVSS 3.0MEDIUM 6.1
  • TI-2017-04631 An issue was discovered in concrete5 <= 5.6.3.4. CVSS 3.0MEDIUM 6.1
  • TI-2014-04178 concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a… CVSS 2.0MEDIUM 5.0
  • TI-2015-01997 Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow… CVSS 2.0MEDIUM 4.3
  • TI-2014-07748 Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and… CVSS 2.0MEDIUM 4.3
  • TI-2014-04179 Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5… CVSS 2.0MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences