CVE-2026-2994

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

PT-2019-11958

Name of the Vulnerable Software and Affected Versions Contao version 4.7 Description The issue allows for a CSRF attack. Security researcher Ali Razzaq has discovered that the request token check can be bypassed. Recommendations For Contao version 4.7, as a temporary workaround, consider...