ConcreteCMS

Latest CVEs · RSS

• CVE-2026-18120 2026-09-16 · CVSS 6.3
  Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission
• CVE-2026-85387 2026-09-16 · CVSS 2.0
  Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been iss
• CVE-2026-87031 2026-09-16 · CVSS 2.1
  n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did
• CVE-2026-87028 2026-09-16 · CVSS 5.3
  Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesti
• CVE-2026-85386 2026-09-16 · CVSS 7.3
  Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by
• CVE-2026-85385 2026-09-16 · CVSS 7.7
  Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management
• CVE-2026-81927 2026-09-15 · CVSS 1.8
  Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject fil
• CVE-2026-18426 2026-09-15 · CVSS 2.0
  Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely
• CVE-2026-81926 2026-09-15 · CVSS 2.0
  Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel
• CVE-2026-81925 2026-09-15 · CVSS 2.1
  Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scri
• CVE-2026-18425 2026-09-15 · CVSS 2.1
  Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_s
• CVE-2026-18424 2026-09-15 · CVSS 2.1
  Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple r
• CVE-2026-18423 2026-09-15 · CVSS 2.1
  Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authe
• CVE-2026-18422 2026-09-15 · CVSS 2.1
  Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend a
• CVE-2026-18421 2026-09-15 · CVSS 2.1
  Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source
• CVE-2026-68529 2026-09-15 · CVSS 2.1
  Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in Das
• CVE-2026-68530 2026-09-15 · CVSS 2.1
  Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details
• CVE-2026-68531 2026-09-15 · CVSS 2.1
  Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, all
• CVE-2026-81924 2026-09-15 · CVSS 2.1
  Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controll
• CVE-2026-81923 2026-09-15 · CVSS 2.1
  In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the
• CVE-2026-81922 2026-09-15 · CVSS 2.1
  Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, th
• CVE-2026-81921 2026-09-15 · CVSS 2.3
  Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a val
• CVE-2026-81920 2026-09-15 · CVSS 2.3
  Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the admini
• CVE-2026-68532 2026-09-15 · CVSS 2.3
  Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unau
• CVE-2026-68533 2026-09-15 · CVSS 2.3
  Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permissi