Portlandlabs Concrete5 Cross-Site Scripting Vulnerability (CNVD-2021-94047)

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "mode" parameter to inject arbitrary web...

CVE-2021-41464

Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...

CVE-2021-41462

Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter...

CVE-2021-41464

CVE-2021-41464 affects concrete5-legacy 5.6.4.0 and earlier; Cross-site scripting via concrete/elements/collection_add.php (rel parameter) allows remote attackers to inject arbitrary web script/HTML. This is confirmed by multiple sources (NVD, Red Hat, CNVD). The provided documents do not specify...

CVE-2021-41465

CVE-2021-41465 affects concrete5-legacy 5.6.4.0 and earlier. The issue is a cross-site scripting (XSS) vulnerability in the file collection_theme.php , exploitable via the rel parameter, enabling remote attackers to inject arbitrary web script or HTML. The connected documents corroborate the affe...

CVE-2021-41462

CVE-2021-41462 : In concrete5-legacy versions ≤ 5.6.4.0, a cross-site scripting (XSS) flaw exists in concrete/elements/collection_add.php via the ctID parameter. This allows remote attackers to inject arbitrary web script or HTML. The affected product is concrete5-legacy 5.6.4.0 and earlier. The ...

Portlandlabs Concrete5 跨站脚本漏洞

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "mode" parameter to inject arbitrary web...