CVE-2026-93659-writeup

CVE-2026-93659: Concrete CMS Community Store における格納型 XSS が管理者ダッシュボードの乗っ取りにつながる 概要 | ---|--- CVE| CVE-2026-93659 コンポーネント| concretecms-community-store/communitystore 種類| 格納型クロスサイトスクリプティング CWE-79 深刻度| CVSS v4.0 9.3 緊急 / v3.1 8.7 高 影響を受けるバージョン| 2.7.8 より前のすべてのバージョン 修正バージョン| 2.7.8 クレジット| Prince Edem...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

PT-2026-96817

Name of the Vulnerable Software and Affected Versions Concrete CMS Community Store versions prior to 2.7.8 Description Digital product download tokens are derived from order creation timestamps rather than random values, which makes the tokens predictable. Unauthenticated attackers can enumerate...

CVE-2026-95653: Generation of Predictable Numbers or Identifiers

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-93659

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93659

Concrete CMS Community Store before version 2.7.8 is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to sanitize or HTML-escape customer-supplied fields, such as billing name, email, and phone numbers. These fields are stored as-is and rendered in four locations: the admin order ...

EUVD-2026-82941

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

PT-2026-95428

Name of the Vulnerable Software and Affected Versions Concrete CMS Community Store versions prior to 2.7.8 Description The software fails to perform HTML escaping on customer-supplied order fields within checkout and admin views. This allows unauthenticated attackers to store malicious script...

CVE-2026-93659: Improper Neutralization of Input During Web Page Generation

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...