2533 matches found
CVE-2026-8337
CVE-2026-8337 CVE-2026-8337 es una vulnerabilidad de Referencia Directa a Objetos Insegura IDOR en Concrete CMS que afecta a la función de Encuestas. A diferencia de CVE-2026-8347 que involucraba asociaciones de Express, esta vulnerabilidad permite que un atacante no autenticado participe en una...
Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...
Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)
Concrete CMS = 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/messagedetail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments. id: CVE-2026-8237 info: name: Concrete CMS = 9.5.0 - Unauthenticated Conversation...
Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. id: CVE-2026-6826 info: name: Concrete CMS 9.5.1 - Unauthenticated File Usage Disclosure author: str4k3r severity: medium description: | Concrete CMS 9.5.0 and...
CVE-2026-8347
CVE-2026-8347 – Referencia Directa a Objetos Insegura IDOR en Concrete CMS Resumen CVE-2026-8347 es una vulnerabilidad de Referencia Directa a Objetos Insegura IDOR que afecta a Concrete CMS versiones 9.5.0 y anteriores. El problema existe en la funcionalidad de Reordenación de Asociaciones Expre...
CVE-2026-8239
CVE-2026-8239 CVE-2026-8239 es una vulnerabilidad de Referencia Directa a Objetos Insegura IDOR que afecta a Concrete CMS 9.5.0 y anteriores.La vulnerabilidad existe en el endpoint /ccm/frontend/conversations/getrating, que permite a un atacante determinar si existe un mensaje de conversación y...
CVE-2026-8237
CVE-2026-8237 CVE-2026-8237 es una vulnerabilidad de Referencia Directa Insegura a Objetos IDOR causada por la falta de comprobaciones de autorización en Concrete CMS 9.5.0 y anteriores. La falla existe en el endpoint /ccm/frontend/conversations/messagedetail, que devuelve el contenido completo d...
CVE-2026-93659-writeup
CVE-2026-93659: Stored XSS in Concrete CMS Community Store Leads to Admin Dashboard Takeover Summary | ---|--- CVE| CVE-2026-93659 Component| concretecms-community-store/communitystore Type| Stored Cross-Site Scripting CWE-79 Severity| CVSS v4.0 9.3 Critical / v3.1 8.7 High Affected| All versions...
CVE-2026-18110-PoC
CVE-2026-18110 — Concrete CMS Unauthenticated User Enumeration Summary Concrete CMS 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. Thi...
[SECURITY] Fedora 44 Update: rust-libcst-1.9.0-1.fc44
A Python parser and Concrete Syntax Tree library...
[SECURITY] Fedora 43 Update: rust-libcst-1.9.0-1.fc43
A Python parser and Concrete Syntax Tree library...
CVE-2026-95653
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...
CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...
CVE-2026-95653
Concrete CMS Community Store versions before 2.7.8 contain a predictable digital download token vulnerability. The root cause is that download tokens are derived from order creation timestamps rather than cryptographically random values (in Download.php). Because order and file identifiers are se...
EUVD-2026-84524
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...
CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...
CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...
PT-2026-96817
Name of the Vulnerable Software and Affected Versions Concrete CMS Community Store versions prior to 2.7.8 Description Digital product download tokens are derived from order creation timestamps rather than random values, which makes the tokens predictable. Unauthenticated attackers can enumerate...
CVE-2026-95653: Generation of Predictable Numbers or Identifiers
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...
