CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

EUVD-2026-76689

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917

Concrete CMS versions below 9.5.3 contain a Stored XSS vulnerability in the Document Library block . The block controller returned the file description and tags values without applying the h() HTML-escaping function (already used for the title column), and the block view template wrote those valu...

CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2026-81911

Concrete CMS versions 9.0.0 through 9.5.2 contain a Stored XSS in the Board Custom Slot dialog. The custom_slot save_template endpoint authorizes requests only against the target board instance via canEditBoardContents() but persists the client-supplied selectedTemplateOption[collection] verbatim...

CVE-2026-54047

creationtimestamp| type| source ---|---|--- 2026-09-11 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb3rquccx2f 2026-09-11 18:08:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hh4d5o26wjn56 2026-09-11 18:08:41+00:00| seen|...

CVE-2026-72708

creationtimestamp| type| source ---|---|--- 2026-09-11 17:12:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/f7bg27osoyjba 2026-09-11 20:58:34+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvbhgioimc2x 2026-10-25 03:00:08+00:00| seen|...

CVE-2026-89066

creationtimestamp| type| source ---|---|--- 2026-09-11 17:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvb262jwf322...

CVE-2026-89262

creationtimestamp| type| source ---|---|--- 2026-09-11 17:00:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5ryrbzc5x73be 2026-09-11 17:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvb25syizs2m...

CVE-2026-86340

creationtimestamp| type| source ---|---|--- 2026-09-11 14:00:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvaq2esev62q 2026-09-14 07:45:32+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260914 2026-09-14 07:46:08+00:00| seen|...

CVE-2026-89178

creationtimestamp| type| source ---|---|--- 2026-09-11 08:45:28+00:00| seen| https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html 2026-09-11 09:39:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eye6iojklzlt4 2026-09-11 11:01:46+00:00| seen|...

CVE-2026-86781

creationtimestamp| type| source ---|---|--- 2026-09-11 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mva2bi7jx72x 2026-09-11 07:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/117251232554267501 2026-09-11 08:10:57+00:00| seen|...

CVE-2026-64837

creationtimestamp| type| source ---|---|--- 2026-09-11 05:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7tkbexcy2n...

CVE-2026-75714

creationtimestamp| type| source ---|---|--- 2026-09-11 05:09:36+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv7sfn7pzv2f...

CVE-2026-63695

creationtimestamp| type| source ---|---|--- 2026-09-11 01:32:47+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mv7gbvovoh2t 2026-09-11 02:14:14+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mv7ilztmfu2j 2026-09-15 16:01:20+00:00| seen|...

PT-2026-90498

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917: Improper Neutralization of Input During Web Page Generation

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-78573

creationtimestamp| type| source ---|---|--- 2026-09-10 23:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv76crcczs2p 2026-09-11 00:07:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv7bk7xutw25 2026-09-17 04:37:08+00:00| seen|...