CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

CVE•added 2026/05/21 9:32 p.m.•9 views

CVE-2026-8410

Concrete CMS versions 9.0.0–9.4.9 are vulnerable to Cross-Site Request Forgery (CSRF) at the endpoint concrete/controllers/dialog/logs/bulk/delete. The issue stems from that specific path and affects versions up to 9.4.9; upgrading to 9.5.0 or later is recommended. The data in connected sources c...

8.8CVSS5.8AI score0.00022EPSS

Vulnrichment•added 2026/05/21 9:32 p.m.•3 views

CVE-2026-8411 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonata...

Cvelist•added 2026/05/21 9:32 p.m.•24 views

CVE-2026-8411 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete

CVE•added 2026/05/21 9:32 p.m.•8 views

CVE-2026-8411

CVE-2026-8411 affects Concrete CMS 9.0.0–9.4.x, with CSRF at the endpoint concrete/controllers/dialog/page/bulk/delete. The issue is confirmed across multiple sources and is fixed in 9.5.0+. Exploitation requires user interaction and is scoped as a low CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC...

ATTACKERKB•added 2026/05/21 9:32 p.m.•1 views

CVE-2026-8411

Cvelist•added 2026/05/21 9:31 p.m.•27 views

CVE-2026-8412 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

ATTACKERKB•added 2026/05/21 9:31 p.m.•2 views

CVE-2026-8412

CVE•added 2026/05/21 9:31 p.m.•9 views

CVE-2026-8412

Concrete CMS prior to version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at the endpoint concrete/controllers/dialog/page/bulk/cache. The issue is caused by insufficient verification of user intent for requests to that endpoint. Impact is described as CSRF with potential to perform ...

Vulnrichment•added 2026/05/21 9:31 p.m.•3 views

CVE-2026-8412 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

ATTACKERKB•added 2026/05/21 9:30 p.m.•1 views

CVE-2026-8413

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonata...

Vulnrichment•added 2026/05/21 9:30 p.m.•1 views

CVE-2026-8413 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design

Cvelist•added 2026/05/21 9:30 p.m.•22 views

CVE-2026-8413 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design

CVE•added 2026/05/21 9:30 p.m.•7 views

CVE-2026-8413

Concrete CMS

ATTACKERKB•added 2026/05/21 9:29 p.m.•2 views

CVE-2026-8414

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

Cvelist•added 2026/05/21 9:29 p.m.•24 views

CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate

CVE•added 2026/05/21 9:29 p.m.•7 views

CVE-2026-8414

Concrete CMS 9.x before 9.5.0 is affected by a CSRF vulnerability in the endpoint concrete/controllers/dialog/event/duplicate. Technical details from PT-2026-42570 indicate versions 9.0.0 through 9.4.x are vulnerable, with exploitation via the affected endpoint. The recommended fix is to upgrade ...

Vulnrichment•added 2026/05/21 9:29 p.m.•4 views

CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate

CVE•added 2026/05/21 9:29 p.m.•7 views

CVE-2026-8415

Concrete CMS 9.x before 9.5.0 is vulnerable to Cross-Site Request Forgery at the endpoint concrete/controllers/dialog/express/association/reorder. Affected versions include 9.0.0 through 9.4.x. Root cause is CSRF in the reorder action; exploitation details are not provided in the documents beyond...

Vulnrichment•added 2026/05/21 9:29 p.m.•2 views

CVE-2026-8415 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N...