MEDIUMPackagist
GHSA-vpgr-cwfx-pwfw· CVE-2026-8240Concrete CMS is vulnerable to unauthenticated page metadata disclosure
Modified: 9/10/2026
package
Packagist/concrete5/concrete5
pkg:packagist/concrete5/concrete5
MEDIUM6.1Packagist
GHSA-vq39-q549-g786· CVE-2022-43967Concrete CMS vulnerable to Cross-site Scripting via multilingual report
Modified: 11/8/2023
LOW2.0Packagist
GHSA-w6j6-w6jx-vf2r· CVE-2024-7394Concrete CMS Stored XSS in getAttributeSetName
Modified: 1/21/2025
HIGH8.8Packagist
GHSA-w8fp-3gwq-gxpw· CVE-2022-43693Concrete CMS vulnerable to Cross-site Request Forgery
Modified: 4/30/2025
MEDIUM4.8Packagist
GHSA-w9qg-chfh-g3q9· CVE-2026-3242Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Modified: 3/4/2026
HIGH8.2Packagist
GHSA-284f-f2hw-j2gx· CVE-2021-22958Server-Side Request Forgery vulnerability in concrete5
Modified: 11/8/2023
MEDIUM5.4Packagist
GHSA-2ggc-552c-rmqr· CVE-2023-28476Stored cross site scripting on tags
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-2j26-j953-2rph· CVE-2023-28474Stored cross site scripting on saved presets
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-2mvg-c6mg-3q63· CVE-2017-7725Concrete CMS vulnerable to cross-site scripting (XSS)
Modified: 2/19/2024
MEDIUMPackagist
GHSA-2xp7-rpvc-pjwc· CVE-2026-8239Concrete CMS is vulnerable to IDOR
Modified: 9/10/2026
LOW3.5Packagist
GHSA-36fr-3wg8-q5v8· CVE-2023-48649Concrete CMS Cross-site Scripting vulnerability
Modified: 2/16/2024
LOW3.1Packagist
GHSA-3cpf-jmmc-8jm3· CVE-2024-4353Concrete CMS vulnerable to Stored Cross-site Scripting
Modified: 1/21/2025
MEDIUM6.5Packagist
GHSA-3cxx-3f53-m92c· CVE-2022-43686Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS
Modified: 2/16/2024
MEDIUM4.3Packagist
GHSA-3rxx-8f33-7p6p· CVE-2023-48653Concrete CMS Cross Site Request Forgery (CSRF) vulnerability
Modified: 12/16/2024
MEDIUM5.4Packagist
GHSA-437p-jfm4-2387· CVE-2023-44766ConcreteCMS Cross-site Scripting vulnerability
Modified: 9/10/2026
LOWPackagist
GHSA-44q4-354f-c826· CVE-2026-8435Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()
Modified: 9/10/2026
MEDIUMPackagist
GHSA-45fj-fvmm-xcc5· CVE-2026-3240Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Modified: 3/4/2026
MEDIUM4.3Packagist
GHSA-45m2-8q7f-93wv· CVE-2023-48651Concrete CMS Cross Site Request Forgery (CSRF) vulnerability
Modified: 12/16/2024
MEDIUM5.3Packagist
GHSA-46xh-7854-f568· CVE-2026-8205Concrete CMS is vulnerable to authorization bypass in the Calendar Block
Modified: 9/10/2026
LOW3.5Packagist
GHSA-474f-mcjv-pgrm· CVE-2023-28819Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names
Modified: 9/10/2026
HIGHPackagist
GHSA-4c8m-6fwx-m7xq· CVE-2026-8421Concrete CMS contains a CSRF vulnerability
Modified: 9/10/2026
MEDIUMPackagist
GHSA-4g7q-44qp-cc5c· CVE-2026-6826Concrete CMS is vulnerable to unauthenticated file usage disclosure
Modified: 9/10/2026
LOW2.2Packagist
GHSA-4m7h-34xm-4wjv· CVE-2024-2179Concrete CMS Stored Cross-site Scripting vulnerability
Modified: 9/10/2026
MEDIUMPackagist
GHSA-4pcg-pjp5-3mc6· CVE-2025-8571Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
Modified: 8/6/2025
MEDIUM5.4Packagist
GHSA-4qv6-37xq-mgq2· CVE-2023-44760Concrete CMS Cross-site Scripting vulnerability
Modified: 9/10/2026
HIGHPackagist
GHSA-52pr-7vmf-2w7x· CVE-2026-7888Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
Modified: 7/14/2026
LOWPackagist
GHSA-56c9-xq5g-xrf9· CVE-2026-8409Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
Modified: 9/10/2026
MEDIUMPackagist
GHSA-58c8-vvqw-cm7m· CVE-2026-8236Concrete CMS is vulnerable to IDOR combined with a missing authentication gate
Modified: 9/10/2026
HIGHPackagist
GHSA-5rj5-gfmr-hrc3· CVE-2026-8426Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`
Modified: 9/10/2026
HIGH7.2Packagist
GHSA-645j-cm4x-3xvw· CVE-2026-8134Concrete CMS Vulnerable to Relative Path Traversal
Modified: 9/10/2026
LOWPackagist
GHSA-66rg-92q4-6m8q· CVE-2026-7882Concrete CMS is vulnerable to unauthorized file deletion
Modified: 9/10/2026
LOWPackagist
GHSA-67hj-8239-cmf5· CVE-2026-8427Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-6fm3-r6mf-j875· CVE-2023-44762ConcreteCMS Cross-site Scripting vulnerability
Modified: 9/10/2026
LOWPackagist
GHSA-6fxm-r8p3-mx5c· CVE-2026-8433Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()
Modified: 9/10/2026
LOWPackagist
GHSA-6mxw-2vhf-42g5· CVE-2026-2994Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)
Modified: 3/4/2026
LOWPackagist
GHSA-6qjh-p324-694f· CVE-2026-8434Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-6xx7-r8x4-fpjp· CVE-2023-44765ConcreteCMS Cross-site Scripting vulnerability
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-7388-7vq2-m4f4· CVE-2021-28145Concrete CMS Cross-site Scripting via Survey Blocks
Modified: 2/16/2024
LOWPackagist
GHSA-752x-23hp-jmv6· CVE-2026-8411Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
Modified: 9/10/2026
MEDIUM4.8Packagist
GHSA-8699-h45g-7hm8· CVE-2022-43695Concrete CMS Cross-site Scripting vulnerability
Modified: 5/14/2025
MEDIUM6.1Packagist
GHSA-8782-xgh5-r7mv· CVE-2022-43968Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons
Modified: 11/8/2023
MEDIUMPackagist
GHSA-8c7c-h7px-267g· CVE-2026-8337Concrete CMS is vulnerable to IDOR in surveys
Modified: 9/10/2026
LOWPackagist
GHSA-97jw-gr4m-c5v8· CVE-2026-8432Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()
Modified: 9/10/2026
LOWPackagist
GHSA-98qf-jvwj-2r5f· CVE-2026-8414Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Modified: 9/10/2026
MEDIUM4.8Packagist
GHSA-998c-q8hh-h8gv· CVE-2024-8660Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block
Modified: 9/17/2024
MEDIUM5.4Packagist
GHSA-9h33-5fxw-r2xv· CVE-2023-28471Stored cross site scripting via container name
Modified: 9/10/2026
MEDIUM4.8Packagist
GHSA-9jc5-9wh5-mc36· CVE-2022-43688Concrete CMS vulnerable to Cross-site Scripting
Modified: 11/8/2023
LOW3.1Packagist
GHSA-9qhc-pg6j-wf23· CVE-2024-3180Concrete CMS Stored XSS in blocks of type file
Modified: 8/8/2024
HIGHPackagist
GHSA-9v2g-37mp-qpxf· CVE-2026-8203Concrete CMS has Stored XSS through its height parameter
Modified: 9/10/2026
LOW2.0Packagist
GHSA-9v3w-cj7m-qh5g· CVE-2024-1246Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature
Modified: 2/16/2024
LOW2.4Packagist
GHSA-9xxv-q6pp-96wq· CVE-2023-49337Concrete CMS Stored XSS
Modified: 12/16/2024
LOW2.0Packagist
GHSA-c47w-9mcf-w972· CVE-2024-7512Concrete CMS vulnerable to Stored Cross-site Scripting
Modified: 8/30/2024
LOWPackagist
GHSA-c5xf-rmv4-j85h· CVE-2025-8573Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page
Modified: 8/6/2025
MEDIUMPackagist
GHSA-chfm-cm6h-q5x7· CVE-2026-7881Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block
Modified: 9/10/2026
MEDIUMPackagist
GHSA-cmm4-p9v2-q453· CVE-2025-3153Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)
Modified: 4/4/2025
MEDIUM4.8Packagist
GHSA-f4vq-pj32-gr4q· CVE-2026-3241Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Modified: 3/4/2026
LOWPackagist
GHSA-f54h-78c9-c24h· CVE-2026-7887Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status
Modified: 9/10/2026
MEDIUM5.3Packagist
GHSA-f55r-8rcv-mqcf· CVE-2023-28472Concrete CMS missing secure cookie parameters
Modified: 9/10/2026
MEDIUMPackagist
GHSA-f73j-pm2c-rxvr· CVE-2026-8245Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination
Modified: 9/10/2026
LOW2.0Packagist
GHSA-fgxj-g7x3-85cq· CVE-2023-28820Stored cross site scripting in RSS displayer
Modified: 9/10/2026
MEDIUMPackagist
GHSA-fqg3-8w8r-8g94· CVE-2026-7879Concrete CMS has an unauthorized file access issue
Modified: 7/21/2026
MEDIUM5.3Packagist
GHSA-g4gm-pxh3-29fq· CVE-2020-14961Unrestricted Uploads in Concrete5
Modified: 11/8/2023
HIGHPackagist
GHSA-g7xp-jf3x-wcx4· CVE-2026-8350Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php
Modified: 9/10/2026
HIGHPackagist
GHSA-g82f-9pw7-773w· CVE-2026-10721Concrete CMS: PHP Object Injection via unserialize() calls
Modified: 8/12/2026
HIGHPackagist
GHSA-gj26-w59c-29mf· CVE-2026-3452Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection
Modified: 3/4/2026
LOWPackagist
GHSA-gjwq-9v8p-47w7· CVE-2026-7890Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation
Modified: 9/10/2026
HIGHPackagist
GHSA-gr23-g276-xc73· CVE-2021-22954Cross Site Request Forgery in concrete5/concrete5
Modified: 9/10/2026
HIGHPackagist
GHSA-h72c-xx3w-w8h7· CVE-2026-8197Concrete CMS is vulnerable to Stored XSS via OAuth integration name
Modified: 9/10/2026
HIGH7.2Packagist
GHSA-hf9p-9r39-r2h3· CVE-2020-11476Unrestricted Uploads in Concrete5
Modified: 2/18/2024
MEDIUM5.4Packagist
GHSA-j6h5-ggv2-3rfv· CVE-2023-44764ConcreteCMS Cross-site Scripting vulnerability
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-jfmc-3975-fv5f· CVE-2022-43694Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library
Modified: 11/8/2023
LOWPackagist
GHSA-jqvq-gv67-3567· CVE-2026-8347Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog
Modified: 9/10/2026
HIGHPackagist
GHSA-jr5g-qv3g-rxxx· CVE-2026-8417Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>`
Modified: 9/10/2026
LOWPackagist
GHSA-jxhp-rwqv-9fjj· CVE-2015-3989concrete5 vulnerable to Cross-site Scripting
Modified: 4/14/2025
MEDIUM5.4Packagist
GHSA-m53v-5x5x-5m2p· CVE-2022-43687Concrete CMS vulnerable to Session Fixation
Modified: 11/8/2023
MEDIUMPackagist
GHSA-m87h-jxr6-f82w· CVE-2023-48648Concrete CMS allows unauthorized access because directories can be created with insecure permissions
Modified: 11/30/2024
LOW2.4Packagist
GHSA-mgp6-j658-vcw9· CVE-2024-1245Concrete CMS vulnerable to stored XSS in file tags and description attributes
Modified: 2/16/2024
MEDIUMPackagist
GHSA-mm5f-5rqw-574f· CVE-2026-3244Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Modified: 3/4/2026
LOWPackagist
GHSA-mpq2-mv8p-9wm6· CVE-2026-8413Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-p4jj-gwpg-9jwh· CVE-2023-44761ConcreteCMS Cross-site Scripting vulnerability
Modified: 9/10/2026
MEDIUM6.5Packagist
GHSA-p68c-rmfh-j48h· CVE-2026-30662ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads
Modified: 3/26/2026
LOWPackagist
GHSA-p8p9-5953-h9jw· CVE-2026-7886Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage
Modified: 9/10/2026
LOWPackagist
GHSA-pcrh-gj77-j4mw· CVE-2026-8139Concrete CMS is vulnerable to Stored XSS via external-link page cvName
Modified: 9/10/2026
MEDIUM5.3Packagist
GHSA-ph6g-6v8w-8p6m· CVE-2023-28821Missing rate limit for password resets
Modified: 9/10/2026
LOW2.0Packagist
GHSA-pj42-r64f-4xfq· CVE-2024-2753Concrete CMS Stored XSS on the calendar color settings screen
Modified: 4/10/2024
CRITICAL9.8Packagist
GHSA-pj76-75cm-3552· CVE-2023-28473Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section
Modified: 9/10/2026
HIGHPackagist
GHSA-prxr-vjgc-2cq9· CVE-2026-8428Concrete CMS is Vulnerable to Cross-Site Request Forgery
Modified: 9/10/2026
HIGHPackagist
GHSA-pv2v-6w2v-97x6· CVE-2026-8135Concrete CMS Vulnerable to Deserialization of Untrusted Data
Modified: 9/10/2026
MEDIUMPackagist
GHSA-pvmx-mjmh-jfcx· CVE-2025-0660Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality
Modified: 9/10/2026
LOW2.0Packagist
GHSA-q25h-jch8-gfrp· CVE-2024-1247Concrete CMS vulnerable to stored XSS via the Role Name field
Modified: 2/16/2024
MEDIUM5.3Packagist
GHSA-q3hq-hm5h-qrx3· CVE-2022-43691Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information
Modified: 4/30/2025
MEDIUM5.3Packagist
GHSA-q48r-xg9h-78m8· CVE-2022-43689Concrete CMS vulnerable to XML External Entity
Modified: 11/8/2023
MEDIUM6.3Packagist
GHSA-q56r-mw39-944g· CVE-2022-43690Concrete CMS vulnerable to Improper Authentication
Modified: 11/8/2023
LOW3.0Packagist
GHSA-q5wx-m95r-4cgc· CVE-2024-4350Concrete CMS Stored Cross-site Scripting vulnerability
Modified: 1/21/2025
MEDIUM4.8Packagist
GHSA-q7qr-22qw-pqgx· CVE-2024-8291Cross site scripting in Concrete CMS
Modified: 1/21/2025
LOWPackagist
GHSA-q9fm-mpg8-8jqm· CVE-2026-8353Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme
Modified: 9/10/2026
LOW3.1Packagist
GHSA-qgm9-rxmq-jxmq· CVE-2024-3181Concrete CMS Stored XSS in the Search Field
Modified: 4/10/2024
LOWPackagist
GHSA-qj94-6rx6-27fr· CVE-2026-8416Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
Modified: 9/10/2026
MEDIUM4.3Packagist
GHSA-qp42-5pj7-4ccm· CVE-2023-48652Concrete CMS Cross Site Request Forgery (CSRF)
Modified: 9/10/2026
MEDIUMPackagist
GHSA-qv3x-mffx-9gw8· CVE-2026-8238Concrete CMS is vulnerable to IDOR
Modified: 9/10/2026