Concrete CMS: No CSRF protection when creating new community points actions, and related stored XSS

crayons The functionality to create a new community points action does not have anti-CSRF protection, and the administrator page displaying actions for which a user can be awarded community points does not have XSS protection An attacker could craft a malicious POST request to...