49 matches found
ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field
A vulnerability was found in ConcreteCMS up to 9.3.9. It has been classified as problematic. This affects the function Save of the component HTML Block Handler. The manipulation of the argument content leads to HTML injection. It is possible to initiate the attack remotely. The exploit has been...
CVE-2025-2972
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2969
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2970
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2971
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2971
ConcreteCMS up to 9.3.9 is implicated by CVE-2025-2971, with a cross-site scripting vulnerability in the List Block Handler: manipulating Name/Description triggers remote abuse. Exploit reportedly disclosed; vendor response unclear. Remediation/patch details are not consistently provided across s...
CVE-2025-2968
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2966
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
PT-2025-13643
Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A vulnerability has been found in ConcreteCMS, affecting an unknown function of the component Switch Language Block Handler. The manipulation of the Label argument leads to cross-site scripting. It ...
CVE-2025-2965
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2964
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2965
CVE-2025-2965 has conflicting statuses across sources. Red Hat reports a ConcreteCMS remote‑exploitable cross‑site scripting flaw in the Save function of the Accordion Block Handler affecting up to version 9.3.9, with no fixed version and no remediation version published. CNNVD also indicates the...
CVE-2025-2963
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2963
CVE-2025-2963 is rejected/not used and does not represent an active vulnerability entry.
PT-2025-13642
Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A problematic issue affects the Save function of the Feature Link Block Handler component. The manipulation of the Title/Body Source/Button Text argument leads to cross-site scripting. This issue ca...