CVE-2026-8245

🗓️ 21 May 2026 21:14:18Reported by ConcreteCMSType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

Concrete CMS versions nine point five zero and earlier have reflected XSS in legacy pagination via HTML attribute injection.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-8245	21 May 202621:14	–	attackerkb
Circl	CVE-2026-8245	22 May 202602:48	–	circl
CNNVD	Concrete CMS 安全漏洞	21 May 202600:00	–	cnnvd
Cvelist	CVE-2026-8245 Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection	21 May 202621:14	–	cvelist
EUVD	EUVD-2026-31357	22 May 202600:31	–	euvd
Github Security Blog	Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination	22 May 202600:31	–	github
NVD	CVE-2026-8245	21 May 202622:16	–	nvd
OSV	GHSA-F73J-PM2C-RXVR Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination	22 May 202600:31	–	osv
Positive Technologies	PT-2026-42563	21 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-8245	5 Jun 202619:24	–	redhatcve

NVD

Node

concretecms concrete_cmsRange<9.5.1

[
  {
    "vendor": "Concrete CMS",
    "product": "Concrete CMS",
    "collectionURL": "https://github.com/concretecms/concretecms",
    "repo": "https://github.com/concretecms/concretecms",
    "versions": [
      {
        "status": "affected",
        "version": "5.0",
        "lessThanOrEqual": "9.5.0",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
documentation	www.documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Parameter	Position	Path	Description	CWE
linkURL	query param	dashboard/reports/forms/legacy	Reflected XSS via HTML attribute injection in legacy pagination where the URL value is raw-interpolated into href, enabling attacker-controlled script execution in an authenticated session	CWE-83

17 Jun 2026 11:03Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4

CVSS 46

EPSS0.00139

SSVC

CWE-83