Concrete CMS Concrete CMS

• CVE-2026-6826 Medium 6.9 Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller 1.5%
• CVE-2026-8203 High 7.3 Concrete CMS 9.5.0 and below has Stored XSS on the height parameter 0.1%
• CVE-2026-8197 High 7.3 Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name 0.2%
• CVE-2026-8350 High 7.5 Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group 0.3%
• CVE-2026-8421 High 7.5 Concrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCE 0.2%
• CVE-2026-8428 High 7.5 CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below 0.1%
• CVE-2026-8426 High 7.5 Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwrite 0.2%
• CVE-2026-8140 High 7.5 Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller 0.1%
• CVE-2026-8417 High 7.5 Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller 0.1%
• CVE-2026-8135 High 8.9 Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller. 0.5%
• CVE-2026-8134 Critical 9.4 Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion 0.7%
• CVE-2026-2994 Low 2.3 Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group 0.2%
• CVE-2026-3240 Medium 4.8 Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form 0.2%
• CVE-2026-3241 Medium 4.8 Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block. 0.2%
• CVE-2026-3242 Medium 4.8 Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block 0.2%
• CVE-2026-3244 Medium 4.8 Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names 0.2%
• CVE-2026-3452 High 8.9 Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block. 0.7%
• CVE-2025-8571 Medium 4.8 Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page 0.4%
• CVE-2025-8573 Low 2.0 Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page 0.5%
• CVE-2025-3153 Medium 5.1 Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute 0.2%
• CVE-2025-0660 Medium 4.8 Stored XSS in Folder Function by Rogue Admin 0.3%
• CVE-2024-7398 Medium 4.6 Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature 0.5%
• CVE-2024-8291 Medium 5.1 Concrete CMS Stored XSS in Image Editor Background Color 0.5%
• CVE-2024-8660 Medium 4.6 Stored XSS in the "Top Navigator Bar" block 0.3%
• CVE-2024-8661 Medium 4.6 Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block 0.4%
• CVE-2024-4350 Medium 5.1 Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer 0.5%
• CVE-2024-7512 Medium 4.6 Concrete CMS Stored XSS in Board instances 0.4%
• CVE-2024-7394 Medium 4.6 Concrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName() 0.4%
• CVE-2024-4353 Medium 4.6 Stored XSS in Generate Board Name Input Field 0.3%
• CVE-2024-3181 Low 3.1 Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. 0.4%
• CVE-2024-3180 Low 3.1 Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file 0.4%
• CVE-2024-3179 Low 3.1 Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page 0.4%
• CVE-2024-3178 Low 3.1 Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter 0.4%
• CVE-2024-2753 Low 2.0 Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen 0.4%
• CVE-2024-2179 Low 2.2 Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type 0.3%
• CVE-2024-1245 Low 2.4 Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes 0.4%
• CVE-2024-1246 Low 2.0 Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature 0.5%
• CVE-2024-1247 Low 2.0 Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field 1.2%