CVE-2025-2967: ConcreteCMS HTML Block save HTML injection
A vulnerability was found in ConcreteCMS up to 9.3.9. It has been classified as problematic. This affects the function Save of the component HTML Block Handler. The manipulation of the argument content leads to HTML injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2967?
CVE-2025-2967 has been classified as problematic due to its potential for HTML injection.
How do I fix CVE-2025-2967?
To fix CVE-2025-2967, upgrade to ConcreteCMS version 9.4.0 or later.
What software is affected by CVE-2025-2967?
CVE-2025-2967 affects ConcreteCMS versions up to 9.3.9.
What type of vulnerability is CVE-2025-2967?
CVE-2025-2967 is an HTML injection vulnerability.
Can CVE-2025-2967 be exploited remotely?
Yes, CVE-2025-2967 can be exploited remotely.