CVE-2025-3153

creationtimestamp| type| source ---|---|--- 2025-04-03 03:06:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lluwbcqnqs2i 2025-04-03 05:12:02+00:00| seen| https://t.me/cvedetector/21935 2025-04-03 14:35:21+00:00| published-proof-of-concept|...

CVE-2025-3153 Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute

Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified. Attackers are limited to individuals whom a site administrator has...