An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selectordata.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disablechoose) passed to the "concrete5-legacy-master/web/concrete/tools/files/searchdialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/filestoragelocations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/filetypes.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in singlepages/dashboard/.

Cross-site scripting (XSS) vulnerability in singlepages\downloadfile.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/downloadfile.

Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in singlepages/dashboard/users/groups/bulkupdate.php or (2) instanceid parameter in tools/dashboard/sitemapdragrequest.php.