EUVD-2026-76447

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2026-81911

Concrete CMS versions 9.0.0 through 9.5.2 contain a Stored XSS in the Board Custom Slot dialog. The custom_slot save_template endpoint authorizes requests only against the target board instance via canEditBoardContents() but persists the client-supplied selectedTemplateOption[collection] verbatim...

CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2026-84432

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...

EUVD-2026-75706

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...

CVE-2026-84432 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...

CVE-2026-84432

Concrete CMS versions 9 through 9.5.2 are affected by a CSRF vulnerability in the Boards custom slot dialog controller (custom_slot.php), specifically the saveTemplate() action. The action did not validate an anti-CSRF token, gating only on the canEditBoardContents() permission. A crafted cross-s...