Unscored severity · published May 15, 2015
CVE-2015-3989
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages…
–
CVSS
0.9%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Concrete5 · Concrete5
through 5.7.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3989
www.securityfocus.com
http://www.securityfocus.com/bid/74699
Patch
https://www.concrete5.org/documentation/developers/5.7/background/version-history/5-7-4-release-notes/
More from Concrete5
6.1
CVE-2017-6908
An issue was discovered in concrete5 <= 5.6.3.4
6.1
CVE-2017-6905
An issue was discovered in concrete5 <= 5.6.3.4
–
CVE-2015-2250
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to…
–
CVE-2014-9526
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName…
–
CVE-2014-5108
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP…