CVE-2026-85385

Concrete CMS below 9.5.4 is affected by a stored cross-site scripting (XSS) vulnerability in the user timezone field (uTimezone). The root cause is that the value is not validated on write and is rendered without output encoding on the Dashboard user management page, where Date::getTimezoneDispla...