Latest vulnerabilities for "concretecms concrete cms"

4.8

First published (updated )

CVE-2024-4350

composer/concrete5/concrete5Stored XSS in Board instances

4.8

EPSS

0.04%

First published (updated )

CVE-2024-7512

composer/concrete5/concrete5Stored XSS in getAttributeSetName()

4.8

EPSS

0.05%

First published (updated )

CVE-2024-7394

composer/concrete5/concrete5Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes

4.8

First published (updated )

CVE-2024-1245

composer/concrete5/concrete5Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature

4.8

EPSS

0.04%

First published (updated )

CVE-2024-1246

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

composer/concrete5/concrete5Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field

4.8

EPSS

0.04%

First published (updated )

CVE-2024-1247

Concretecms Concrete CmsCSRF

4.3

First published (updated )

CVE-2023-48652

composer/concrete5/concrete5Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can b…

9.8

First published (updated )

CVE-2023-48648

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-48649

composer/concrete5/concrete5XSS

5.4

First published (updated )

CVE-2023-44760

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsXSS, Malicious File Upload

5.4

First published (updated )

CVE-2023-44763

composer/concrete5/concrete5XSS

5.4

EPSS

0.04%

First published (updated )

CVE-2023-44764

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-44766

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-44761

composer/concrete5/concrete5XSS

5.4

First published (updated )

CVE-2023-44762

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-44765

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-28476

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2023-28475

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-28474

Concretecms Concrete CmsConcrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for…

5.3

First published (updated )

CVE-2023-28472

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsConcrete CMS (previously concrete5) before 9.2 is vulnerable to possible Auth bypass in the jobs sec…

9.8

First published (updated )

CVE-2023-28473

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-28471

Concretecms Concrete CmsXSS

5.5

First published (updated )

CVE-2023-28477

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-28819

Concretecms Concrete CmsXSS

5.4

First published (updated )

CVE-2023-28820

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsConcrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

5.3

First published (updated )

CVE-2023-28821

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-43556

Concretecms Concrete CmsXSS

4.8

First published (updated )

CVE-2022-43688

Concretecms Concrete CmsXEE

5.3

First published (updated )

CVE-2022-43689

Concretecms Concrete CmsConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict compar…

6.3

First published (updated )

CVE-2022-43690

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-43967

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-43968

Concretecms Concrete CmsCSRF

8.8

First published (updated )

CVE-2022-43693

Concretecms Concrete CmsConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose se…

5.3

First published (updated )

CVE-2022-43691

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-43694

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new sess…

5.4

First published (updated )

CVE-2022-43687

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-43692

Concretecms Concrete CmsXSS

4.8

First published (updated )

CVE-2022-43695

Concretecms Concrete CmsIn Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteC…

6.5

First published (updated )

CVE-2022-43686

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-30118

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-30120

Concretecms Concrete CmsConcrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and e…

9.8

First published (updated )

CVE-2022-21829

Concretecms Concrete CmsXSS

6.1

First published (updated )

CVE-2022-30119

Concretecms Concrete CmsPath Traversal

9.1

First published (updated )

CVE-2022-30117

Concretecms Concrete CmsCSRF

8.8

First published (updated )

CVE-2021-22954

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Concretecms Concrete CmsAn issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be c…

7.2

First published (updated )

CVE-2021-40101

Concretecms Concrete CmsMalicious File Upload

7.2

First published (updated )

CVE-2021-22968

Concretecms Concrete CmsSSRF

7.5

First published (updated )

CVE-2021-22970

Concretecms Concrete CmsCVE-2021-22951

7.5

First published (updated )

CVE-2021-22951

Concretecms Concrete CmsPrivilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If …

8.8

First published (updated )

CVE-2021-22966

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.