CVE-2026-18117

Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...

PT-2026-91737

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.3 Description Stored Cross-Site Scripting XSS occurs because the Edit Alias dialog only applies the trim function to submitted values without performing proper input neutralization. An authenticated user...