EUVD-2026-78076

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 are affected by a stored XSS in the Page Container icon field. The unvalidated icon value was concatenated into the src attribute of an tag by a helper that did not encode attribute output, allowing a user with delegated access to the Page Containers dashboar...

MAL-2025-5872 Malicious code in @gdcorp-commerce/cx-page-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e7cfb33d83efc9598ba1eef7145194848746d40838198d981254b66fd6a88b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gdcorp-commerce/cx-page-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e7cfb33d83efc9598ba1eef7145194848746d40838198d981254b66fd6a88b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...