https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-6908.htmlhttps://patchthecve.com/cve/CVE-2017-6908.htmlWed, 17 Jun 2026 01:23:18 +0000MEDIUM 6.1: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the cohttps://patchthecve.com/cve/CVE-2017-6905.htmlhttps://patchthecve.com/cve/CVE-2017-6905.htmlWed, 17 Jun 2026 01:23:18 +0000MEDIUM 6.1: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browsehttps://patchthecve.com/cve/CVE-2015-3989.htmlhttps://patchthecve.com/cve/CVE-2015-3989.htmlWed, 17 Jun 2026 00:26:35 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.https://patchthecve.com/cve/CVE-2015-2250.htmlhttps://patchthecve.com/cve/CVE-2015-2250.htmlWed, 17 Jun 2026 00:23:49 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/bannedwords/success, (2) channel parameter to index.php/dashboard/reports/logs/vhttps://patchthecve.com/cve/CVE-2014-9526.htmlhttps://patchthecve.com/cve/CVE-2014-9526.htmlWed, 17 Jun 2026 00:18:32 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/groups/bulkupdate.php or (2) instance_id parameter in tools/dashboard/sitemap_drag_rehttps://patchthecve.com/cve/CVE-2014-5108.htmlhttps://patchthecve.com/cve/CVE-2014-5108.htmlWed, 17 Jun 2026 00:11:04 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.https://patchthecve.com/cve/CVE-2014-5107.htmlhttps://patchthecve.com/cve/CVE-2014-5107.htmlWed, 17 Jun 2026 00:11:04 +0000MEDIUM 5.0: concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.phhttps://patchthecve.com/cve/CVE-2012-5181.htmlhttps://patchthecve.com/cve/CVE-2012-5181.htmlTue, 16 Jun 2026 23:46:23 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.