7 matches found
CVE-2026-18111
Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...
CVE-2025-2969
A vulnerability was found in ConcreteCMS up to 9.3.9. It has been rated as problematic. This issue affects the function Save of the component Feature Link Block Handler. The manipulation of the argument Title/Body Source/Button Text leads to cross site scripting. The attack may be initiated...
CVE-2025-2969
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2969
CVE-2025-2969 affects ConcreteCMS up to 9.3.9. The issue is in the Save function of the Feature Link Block Handler, where manipulation of Title/Body Source/Button Text leads to cross-site scripting (XSS). The attack could be carried out remotely; the exploit has been disclosed to the vendor, whic...
PT-2025-13642
Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A problematic issue affects the Save function of the Feature Link Block Handler component. The manipulation of the Title/Body Source/Button Text argument leads to cross-site scripting. This issue ca...