1756 matches found
CVE-2026-81913
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to an Open Redirect via the rcURL parameter . An attacker can craft a link on the site's own domain that redirects a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft . The same ...
EUVD-2026-76245
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...
CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...
CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...
CVE-2026-81912
Concrete CMS before 9.5.3 contains a Cross-Site Request Forgery (CSRF) flaw in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, allowing a state-changing group move to be processed agains...
EUVD-2026-76243
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...
CVE-2026-81911
Concrete CMS versions 9.0.0 through 9.5.2 contain a Stored XSS in the Board Custom Slot dialog. The custom_slot save_template endpoint authorizes requests only against the target board instance via canEditBoardContents() but persists the client-supplied selectedTemplateOption[collection] verbatim...
EUVD-2026-76447
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...
CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...
EUVD-2026-76193
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...
CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in the Theme Customizer . Style values handled by classes such as ColorStyle, FontFamilyStyle, and ImageStyle are interpolated into server-compiled LESS source without neutralizing LESS syntax. An attacker with th...
CVE-2026-81909
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...
CVE-2026-81908
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...
CVE-2026-68528
Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...
CVE-2026-18122
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...
CVE-2026-81909 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...
CVE-2026-81909
Concrete CMS versions 9 through 9.5.2 contain a Missing Authorization flaw in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php). The function fails to verify that a referenced block is genuinely orphaned on the target page and that the caller holds permiss...
EUVD-2026-76168
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...