CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-81903 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 are affected by a stored XSS in the Page Container icon field. The unvalidated icon value was concatenated into the src attribute of an tag by a helper that did not encode attribute output, allowing a user with delegated access to the Page Containers dashboar...

CVE-2026-81903 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-81903 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

EUVD-2026-78076

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-81903: Improper Neutralization of Input During Web Page Generation

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

PT-2026-91565

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

Malicious code in @gdcorp-commerce/cx-page-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e7cfb33d83efc9598ba1eef7145194848746d40838198d981254b66fd6a88b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @gdcorp-commerce/cx-page-container

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5872 Malicious code in @gdcorp-commerce/cx-page-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e7cfb33d83efc9598ba1eef7145194848746d40838198d981254b66fd6a88b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...