https://vulnogram.org/ Most recent CVEs assigned by Concrete CMS (concretecms). https://vulnogram.org/seaview/icons/concretecms.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-18120 https://vulnogram.org/CVE-2026-18120 Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who… Medium Network Exploitable Wed, 16 Sep 2026 17:16:09 GMT https://vulnogram.org/CVE-2026-85387 https://vulnogram.org/CVE-2026-85387 Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed,… Low Wed, 16 Sep 2026 17:12:05 GMT https://vulnogram.org/CVE-2026-87031 https://vulnogram.org/CVE-2026-87031 n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perform a permission check before creating an account. As a result, any valid OAuth t… Low Wed, 16 Sep 2026 16:40:04 GMT https://vulnogram.org/CVE-2026-87028 https://vulnogram.org/CVE-2026-87028 Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating… Medium Wed, 16 Sep 2026 16:36:56 GMT https://vulnogram.org/CVE-2026-85386 https://vulnogram.org/CVE-2026-85386 Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from… High Wed, 16 Sep 2026 16:33:53 GMT https://vulnogram.org/CVE-2026-85385 https://vulnogram.org/CVE-2026-85385 Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName() returns any non-IANA value unchanged. A stored… High Network Exploitable Wed, 16 Sep 2026 16:30:28 GMT https://vulnogram.org/CVE-2026-81927 https://vulnogram.org/CVE-2026-81927 Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode (concrete.file_manager.images.svg_sanitiz… Low Tue, 15 Sep 2026 20:21:03 GMT https://vulnogram.org/CVE-2026-18426 https://vulnogram.org/CVE-2026-18426 Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than t… Low Tue, 15 Sep 2026 20:16:12 GMT https://vulnogram.org/CVE-2026-81926 https://vulnogram.org/CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-… Low Tue, 15 Sep 2026 20:14:18 GMT https://vulnogram.org/CVE-2026-81925 https://vulnogram.org/CVE-2026-81925 Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tri… Low Tue, 15 Sep 2026 20:07:01 GMT https://vulnogram.org/CVE-2026-18425 https://vulnogram.org/CVE-2026-18425 Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit permission before updating each pag… Low Tue, 15 Sep 2026 19:52:04 GMT https://vulnogram.org/CVE-2026-18424 https://vulnogram.org/CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first `ValidatedRemoteUrl` is retained and reused… Low Tue, 15 Sep 2026 19:49:48 GMT https://vulnogram.org/CVE-2026-18423 https://vulnogram.org/CVE-2026-18423 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore perma… Low Tue, 15 Sep 2026 19:30:13 GMT https://vulnogram.org/CVE-2026-18422 https://vulnogram.org/CVE-2026-18422 Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). As a result, an authenticated user who held the… Low Tue, 15 Sep 2026 19:27:59 GMT https://vulnogram.org/CVE-2026-18421 https://vulnogram.org/CVE-2026-18421 Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and delete_data_source), which resolve a ConfiguredDataSource directly from an attacker-… Low Tue, 15 Sep 2026 19:10:51 GMT https://vulnogram.org/CVE-2026-68529 https://vulnogram.org/CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supp… Low Tue, 15 Sep 2026 19:08:45 GMT https://vulnogram.org/CVE-2026-68530 https://vulnogram.org/CVE-2026-68530 Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instan… Low Tue, 15 Sep 2026 19:06:50 GMT https://vulnogram.org/CVE-2026-68531 https://vulnogram.org/CVE-2026-68531 Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted sea… Low Tue, 15 Sep 2026 19:03:38 GMT https://vulnogram.org/CVE-2026-81924 https://vulnogram.org/CVE-2026-81924 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activate_files() action created PageTemplate records from attacker-supplied pageTempl… Low Tue, 15 Sep 2026 18:55:57 GMT https://vulnogram.org/CVE-2026-81923 https://vulnogram.org/CVE-2026-81923 In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a use… Low Tue, 15 Sep 2026 18:53:26 GMT https://vulnogram.org/CVE-2026-81922 https://vulnogram.org/CVE-2026-81922 Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and send_to_bottom reorder tasks ran after only a generic sitemap-access che… Low Tue, 15 Sep 2026 18:51:33 GMT https://vulnogram.org/CVE-2026-81921 https://vulnogram.org/CVE-2026-81921 Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who ob… Low Tue, 15 Sep 2026 18:48:52 GMT https://vulnogram.org/CVE-2026-81920 https://vulnogram.org/CVE-2026-81920 Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list (concrete.seo.exclude_words) but did not validate th… Low Network Exploitable Tue, 15 Sep 2026 18:46:30 GMT https://vulnogram.org/CVE-2026-68532 https://vulnogram.org/CVE-2026-68532 Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permissi… Low Network Exploitable Tue, 15 Sep 2026 18:44:33 GMT https://vulnogram.org/CVE-2026-68533 https://vulnogram.org/CVE-2026-68533 Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission,… Low Tue, 15 Sep 2026 18:27:03 GMT https://vulnogram.org/CVE-2026-68534 https://vulnogram.org/CVE-2026-68534 Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an… Low Network Exploitable Tue, 15 Sep 2026 18:25:02 GMT https://vulnogram.org/CVE-2026-81919 https://vulnogram.org/CVE-2026-81919 Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no token check,… Low Network Exploitable Tue, 15 Sep 2026 18:22:54 GMT https://vulnogram.org/CVE-2026-81899 https://vulnogram.org/CVE-2026-81899 Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder… High Tue, 15 Sep 2026 17:54:58 GMT https://vulnogram.org/CVE-2026-18115 https://vulnogram.org/CVE-2026-18115 Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). A user with an update-scoped OAuth token and… High Tue, 15 Sep 2026 17:39:04 GMT https://vulnogram.org/CVE-2026-18113 https://vulnogram.org/CVE-2026-18113 In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in t… High Tue, 15 Sep 2026 17:32:16 GMT https://vulnogram.org/CVE-2026-81898 https://vulnogram.org/CVE-2026-81898 In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any da… High Tue, 15 Sep 2026 17:29:31 GMT https://vulnogram.org/CVE-2026-81897 https://vulnogram.org/CVE-2026-81897 In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker witho… High Network Exploitable Tue, 15 Sep 2026 16:47:02 GMT https://vulnogram.org/CVE-2026-81896 https://vulnogram.org/CVE-2026-81896 Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report (concrete/single_pages/dashboard/reports/forms/legacy.php). a rogu… High Tue, 15 Sep 2026 16:44:40 GMT https://vulnogram.org/CVE-2026-18111 https://vulnogram.org/CVE-2026-18111 Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently val… High Tue, 15 Sep 2026 16:42:37 GMT https://vulnogram.org/CVE-2026-81895 https://vulnogram.org/CVE-2026-81895 In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier di… High Tue, 15 Sep 2026 16:39:04 GMT https://vulnogram.org/CVE-2026-81894 https://vulnogram.org/CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parses the attr… High Tue, 15 Sep 2026 16:35:37 GMT https://vulnogram.org/CVE-2026-18110 https://vulnogram.org/CVE-2026-18110 Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "Preview as User" panel and other user-selector components. The endpoint validate… High Network Exploitable Tue, 15 Sep 2026 16:33:36 GMT https://vulnogram.org/CVE-2026-81900 https://vulnogram.org/CVE-2026-81900 Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block per… High Mon, 14 Sep 2026 22:07:58 GMT https://vulnogram.org/CVE-2026-18116 https://vulnogram.org/CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add… High Mon, 14 Sep 2026 22:05:49 GMT https://vulnogram.org/CVE-2026-18117 https://vulnogram.org/CVE-2026-18117 Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input neutralization. An authenticated user holdin… High Mon, 14 Sep 2026 21:27:57 GMT https://vulnogram.org/CVE-2026-81901 https://vulnogram.org/CVE-2026-81901 In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter… High Mon, 14 Sep 2026 20:38:54 GMT https://vulnogram.org/CVE-2026-81902 https://vulnogram.org/CVE-2026-81902 Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target pag… High Network Exploitable Mon, 14 Sep 2026 20:34:23 GMT https://vulnogram.org/CVE-2026-81903 https://vulnogram.org/CVE-2026-81903 Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img ta… High Mon, 14 Sep 2026 20:14:25 GMT https://vulnogram.org/CVE-2026-18119 https://vulnogram.org/CVE-2026-18119 Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session… High Mon, 14 Sep 2026 19:54:11 GMT https://vulnogram.org/CVE-2026-81907 https://vulnogram.org/CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce a failed CS… Medium Network Exploitable Fri, 11 Sep 2026 20:21:48 GMT https://vulnogram.org/CVE-2026-81918 https://vulnogram.org/CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed a page where… Medium Fri, 11 Sep 2026 20:19:58 GMT https://vulnogram.org/CVE-2026-81917 https://vulnogram.org/CVE-2026-81917 Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browse… Medium Fri, 11 Sep 2026 20:16:06 GMT https://vulnogram.org/CVE-2026-68535 https://vulnogram.org/CVE-2026-68535 Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file i… Medium Fri, 11 Sep 2026 20:12:17 GMT https://vulnogram.org/CVE-2026-81916 https://vulnogram.org/CVE-2026-81916 Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express ob… Medium Fri, 11 Sep 2026 20:09:05 GMT https://vulnogram.org/CVE-2026-81915 https://vulnogram.org/CVE-2026-81915 Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(),… Medium Fri, 11 Sep 2026 19:39:03 GMT