6 matches found
EUVD-2026-76690
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...
CVE-2026-81918
Concrete CMS versions below 9.5.3 are affected by a Stored XSS vulnerability in the Date Format field of the Page Attribute Display block . A user holding edit_page_contents permissions can store a payload that executes in the browser of any visitor who views a page where the block is configured ...
CVE-2025-2972
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2972 ConcreteCMS Page Attribute Display Block cross site scripting
A vulnerability, which was classified as problematic, has been found in ConcreteCMS up to 9.3.9. Affected by this issue is some unknown functionality of the component Page Attribute Display Block Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be...
CVE-2025-2972
The CVE-2025-2972 entry is marked with a CNA-rejected note in the Initial document, but connected records describe a ConcreteCMS-specific XSS issue: manipulation of the Title argument in the Page Attribute Display Block Handler can lead to cross-site scripting, affecting ConcreteCMS up to version...