72 matches found
CVE-2025-2964
A vulnerability, which was classified as problematic, was found in ConcreteCMS up to 9.3.9. Affected is the function Save of the component FAQ Block Handler. The manipulation of the argument Navigation/Title Text/Description Source leads to cross site scripting. It is possible to launch the attac...
CVE-2025-2963
A vulnerability, which was classified as problematic, has been found in ConcreteCMS up to 9.3.9. This issue affects the function addEditQuestion of the component Legacy Form Block Handler. The manipulation of the argument Question leads to cross site scripting. The attack may be initiated remotel...
ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field
A vulnerability was found in ConcreteCMS up to 9.3.9. It has been classified as problematic. This affects the function Save of the component HTML Block Handler. The manipulation of the argument content leads to HTML injection. It is possible to initiate the attack remotely. The exploit has been...
GHSA-XFQF-5RHG-5C73 ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field
A vulnerability was found in ConcreteCMS up to 9.3.9. It has been classified as problematic. This affects the function Save of the component HTML Block Handler. The manipulation of the argument content leads to HTML injection. It is possible to initiate the attack remotely. The exploit has been...
CVE-2025-2972
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2972 ConcreteCMS Page Attribute Display Block cross site scripting
A vulnerability, which was classified as problematic, has been found in ConcreteCMS up to 9.3.9. Affected by this issue is some unknown functionality of the component Page Attribute Display Block Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be...
CVE-2025-2972
The CVE-2025-2972 entry is marked with a CNA-rejected note in the Initial document, but connected records describe a ConcreteCMS-specific XSS issue: manipulation of the Title argument in the Page Attribute Display Block Handler can lead to cross-site scripting, affecting ConcreteCMS up to version...
CVE-2025-2970
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2971
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2969
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2971
ConcreteCMS up to 9.3.9 is implicated by CVE-2025-2971, with a cross-site scripting vulnerability in the List Block Handler: manipulating Name/Description triggers remote abuse. Exploit reportedly disclosed; vendor response unclear. Remediation/patch details are not consistently provided across s...
CVE-2025-2970
ConcreteCMS (up to 9.3.9) is affected by a cross-site scripting (XSS) flaw in the Switch Language Block Handler. The vulnerability arises from improper handling of the Label argument, enabling an attacker to inject scripts that get executed by end users’ browsers, potentially enabling cookie thef...
CVE-2025-2967
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2968
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2969
CVE-2025-2969 affects ConcreteCMS up to 9.3.9. The issue is in the Save function of the Feature Link Block Handler, where manipulation of Title/Body Source/Button Text leads to cross-site scripting (XSS). The attack could be carried out remotely; the exploit has been disclosed to the vendor, whic...