CVE-2025-2964

A vulnerability, which was classified as problematic, was found in ConcreteCMS up to 9.3.9. Affected is the function Save of the component FAQ Block Handler. The manipulation of the argument Navigation/Title Text/Description Source leads to cross site scripting. It is possible to launch the attac...

CVE-2025-2964

ConcreteCMS (up to 9.3.9) is reported vulnerable due to an XSS in the Save function of the FAQ Block Handler. The issue arises from manipulation of the Navigation/Title Text/Description Source argument, enabling remote attacker access. Public exploit details exist; the vendor was contacted but di...