CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

PT-2022-20010

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.5.7 and below Concrete CMS versions 9.0 through 9.0.2 Description The issue is related to insufficient sanitation of built URLs in the /dashboard/reports/logs/view endpoint, which can be exploited for XSS attacks. This...