CVE-2026-8197

Concrete CMS 9.5.0 and earlier is affected by a Stored XSS via the OAuth integration name. The integration name (admin-controlled) is rendered through the t() translation helper as a sprintf-style format, with the ... wrapper built by PHP string interpolation before t() runs, allowing the integra...