LOW3.5

GHSA-xfqf-5rhg-5c73

ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field

Details

A vulnerability was found in ConcreteCMS up to 9.3.9. It has been classified as problematic. This affects the function Save of the component HTML Block Handler. The manipulation of the argument content leads to HTML injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/concrete5/concrete5

Introduced in: 0

No fixed version published yet for concrete5/concrete5 (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-2967[ADVISORY]
https://github.com/concretecms/concretecms[PACKAGE]
https://github.com/yaowenxiao721/Poc/blob/main/Concretecms/Concretecms-poc5.md[WEB]
https://vuldb.com/?ctiid.302019[WEB]
https://vuldb.com/?id.302019[WEB]
https://vuldb.com/?submit.522417[WEB]