Cross-site Scripting (XSS)

concrete5/concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not sanitize several parameters in web/concrete/singlepages/dashboard/users/groups/bulkupdate.php and web/concrete/tools/dashboard/sitemapdragrequest.php, allowing a malicious user to inject and execute...

Cross-site Scripting (XSS)

concrete5 is vulnerable to cross-site scripting XSS attacks. The library fails to sanitize user input to bulkupdate.php and sitemapdragrequest.php, allowing a malicious user to inject and execute arbitrary script...

CVE-2014-9526

Multiple cross-site scripting XSS vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 gName parameter in singlepages/dashboard/users/groups/bulkupdate.php or 2 instanceid parameter in tools/dashboard/sitemapdragrequest.p...