CVE-2026-81907

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

EUVD-2026-76691

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

PT-2026-90496

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Cross-Site Request Forgery CSRF occurs in the Express Clear Entries function. The issue exists because the controller records a failed CSRF token check but does not enforce it, allowing...