72 matches found
CVE-2025-2963
CVE-2025-2963 is rejected/not used and does not represent an active vulnerability entry.
GHSA-WRP2-6V6J-HFMG ConcreteCMS vulnerable to Stored Cross-site Scripting
Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail file upload, which allows Cross-Site Scripting XSS...
Cross Site Scripting (XSS)
ConcreteCMS is vulnerable to Cross Site Scripting. The vulnerability is due to injecting a crafted script into the Forms of the Data objects. The attacker can exploit this vulnerability by injection malicious JavaScript on client side...
Cross Site Scripting (XSS)
ConcreteCMS is vulnerable to Cross Site Scripting. The vulnerability is due to insufficient input validation in the SITE parameter. This allows an attacker to execute malicious JavaScript on the client side...
GHSA-437P-JFM4-2387 ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings...
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings...
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SITE parameter from installation or in the Settings...
GHSA-P4JJ-GWPG-9JWH ConcreteCMS Cross-site Scripting vulnerability
Multiple Cross Site Scripting XSS vulnerabilities in Concrete CMS v.9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects...
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings...
GHSA-7VX2-5349-QJ99 Withdrawn: ConcreteCMS vulnerable to Xpath injection attacks
Withdrawn This advisory has been withdrawn because it has been found not to be a security issue and withdrawn by its CNA. Please see the message from NVD here for more information. This link is maintained to preserve external references. Original Description ConcreteCMS v9.1.3 was discovered to b...
Withdrawn: ConcreteCMS vulnerable to Xpath injection attacks
Withdrawn This advisory has been withdrawn because it has been found not to be a security issue and withdrawn by its CNA. Please see the message from NVD here for more information. This link is maintained to preserve external references. Original Description ConcreteCMS v9.1.3 was discovered to b...