CVEs published by ConcreteCMS

CVEs published by ConcreteCMS (CVE Numbering Authority). 65 tracked.

• CVE-2026-18111 MEDIUM 6.1 UPGRADE Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link,
• CVE-2026-18117 MEDIUM 5.4 UPGRADE Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName)
• CVE-2026-68526 MEDIUM 4.3 UPGRADE Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controlle
• CVE-2026-81912 MEDIUM 5.7 UPGRADE Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
• CVE-2026-81913 MEDIUM 6.1 UPGRADE Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter
• CVE-2026-81915 MEDIUM 5.3 UPGRADE Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated
• CVE-2026-68535 MEDIUM 4.3 UPGRADE Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type control
• CVE-2026-81907 HIGH 7.1 UPGRADE Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries"
• CVE-2026-81897 MEDIUM 5.4 UPGRADE In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller di
• CVE-2026-81896 MEDIUM 5.4 UPGRADE Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when
• CVE-2026-81895 HIGH 7.2 UPGRADE In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsI
• CVE-2026-81894 MEDIUM 5.4 UPGRADE Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery bloc
• CVE-2026-18110 HIGH 7.5 UPGRADE Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete
• CVE-2026-81925 MEDIUM 6.1 UPGRADE Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversatio
• CVE-2026-18426 MEDIUM 6.5 UPGRADE Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block
• CVE-2026-81926 MEDIUM 6.1 UPGRADE Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location pan
• CVE-2026-85385 CRITICAL 9.6 UPGRADE Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without
• CVE-2026-85386 MEDIUM 6.1 UPGRADE Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-up
• CVE-2026-87028 MEDIUM 6.5 UPGRADE Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview en
• CVE-2026-87031 LOW 2.7 UPGRADE n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() me
• CVE-2026-18120 MEDIUM 5.9 UPGRADE Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON witho
• CVE-2026-85387 HIGH 7.1 UPGRADE Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-che
• CVE-2026-18425 LOW 2.7 UPGRADE Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashb
• CVE-2026-18424 HIGH 7.1 UPGRADE Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port re
• CVE-2026-18423 HIGH 7.1 UPGRADE Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express save
• CVE-2026-18422 MEDIUM 6.5 UPGRADE Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF t
• CVE-2026-81924 MEDIUM 6.5 UPGRADE Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activa
• CVE-2026-18116 MEDIUM 6.1 UPGRADE Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML es
• CVE-2026-81898 HIGH 7.5 In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping
• CVE-2026-68532 LOW 2.3 Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resu
• CVE-2026-18113 HIGH 7.5 In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names befor
• CVE-2026-18119 CRITICAL 9.0 UPGRADE Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them i
• CVE-2026-81901 HIGH 8.7 UPGRADE In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not
• CVE-2026-81902 HIGH 8.1 UPGRADE Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeO
• CVE-2026-81903 MEDIUM 5.4 UPGRADE Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard with
• CVE-2026-81911 MEDIUM 5.4 UPGRADE Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog
• CVE-2026-81921 MEDIUM 5.4 UPGRADE Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream Leagu
• CVE-2026-81922 LOW 2.7 UPGRADE Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitema
• CVE-2026-81923 LOW 2.7 UPGRADE In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions bef
• CVE-2026-81920 MEDIUM 4.3 UPGRADE Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page
• CVE-2026-81919 MEDIUM 4.3 UPGRADE Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the ar
• CVE-2026-81916 MEDIUM 4.3 UPGRADE Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity
• CVE-2026-81917 MEDIUM 5.4 UPGRADE Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rend
• CVE-2026-81927 MEDIUM 5.4 UPGRADE Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling
• CVE-2026-81918 MEDIUM 4.8 UPGRADE Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display b
• CVE-2026-81900 MEDIUM 6.1 UPGRADE Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printe
• CVE-2026-81899 HIGH 7.3 Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the M
• CVE-2026-18115 HIGH 7.4 Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user wr
• CVE-2026-68534 LOW 2.3 Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, result
• CVE-2026-18421 LOW 2.1 Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data sourc
• CVE-2026-68529 LOW 2.1 Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search das
• CVE-2026-68530 LOW 2.1 Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the B
• CVE-2026-68531 LOW 2.1 Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by
• CVE-2026-68533 LOW 2.3 Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before
• CVE-2026-81910 MEDIUM 6.5 UPGRADE Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Un
• CVE-2026-81908 MEDIUM 6.0 Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint
• CVE-2026-68528 MEDIUM 6.0 Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping,
• CVE-2026-18122 MEDIUM 6.0 Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Auth
• CVE-2026-81909 MEDIUM 5.9 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias()
• CVE-2026-81906 MEDIUM 6.3 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or e
• CVE-2026-81905 MEDIUM 6.3 Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, p
• CVE-2026-18121 MEDIUM 6.3 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lig
• CVE-2026-84432 MEDIUM 5.3 Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller
• CVE-2026-68527 MEDIUM 5.9 Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit
• CVE-2026-81904 MEDIUM 6.3 Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area with

← Back to latest CVEs