Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Concrete CMS 9.2.5 Clear all filters
TI-2024-01159 CVE-2024-1245 · GHSA-mgp6-j658-vcw9

Improper input validation in Concrete CMS

Priority LOW 22

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.004 Published 2024-02-09 Fixed in 9.2.5 CWE-20
TI-2024-01160 CVE-2024-1246 · GHSA-9v3w-cj7m-qh5g

Improper input validation in Concrete CMS

Priority LOW 22

Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00453 Published 2024-02-09 Fixed in 9.2.5 CWE-20