CC
Product
Concrete CMS
118
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Severity mix
Critical 2High 34Medium 71Low 11
Watch
Add Concrete CMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-81918 | 4.8 | Sep 11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block Affected: 5.0.0 through 9.5.2 |
| CVE-2026-8353 | 4.8 | May 22 | Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme Affected: 9.0 through 9.5.0 |
| CVE-2026-8197 | 4.8 | May 21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name Affected: 5.0 through 9.5.0 |
| CVE-2026-3240 | 4.8 | Mar 4 | Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form Affected: 5 before 9.4.8 |
| CVE-2026-3241 | 4.8 | Mar 4 | Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block. Affected: 5 before 9.4.8 |
| CVE-2026-3242 | 4.8 | Mar 4 | Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block Affected: 5 before 9.4.8 |
| CVE-2026-3244 | 4.8 | Mar 4 | Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names Affected: 5 before 9.4.8 |
| CVE-2025-8571 | 4.8 | Aug 5 | Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page Affected: 9.0.0 before 9.4.3; 5.6 before 8.5.21 |
| CVE-2025-8573 | 4.8 | Aug 5 | Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page Affected: 9.0.0 before 9.4.3 |
| CVE-2026-81920 | 4.3 | Sep 15 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint Affected: 5.0.0 through 9.5.2 |
| CVE-2026-81919 | 4.3 | Sep 15 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint Affected: 5.0.0 through 9.5.2 |
| CVE-2026-68535 | 4.3 | Sep 11 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions Affected: 9.2.0 through 9.5.2 |
| CVE-2026-81916 | 4.3 | Sep 11 | Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object Affected: 5.0.0 through 9.5.2 |
| CVE-2026-68526 | 4.3 | Sep 11 | Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller Affected: 9.5.2 |
| CVE-2026-8347 | 4.3 | May 22 | Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog Affected: 5.0 through 9.5.0 |
| CVE-2026-8340 | 4.3 | May 22 | Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion Affected: 5.0 through 9.5.0 |
| CVE-2026-7886 | 4.3 | May 21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter Affected: 5.0 through 9.5.0 |
| CVE-2026-7882 | 4.3 | May 21 | Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller Affected: 5.0 through 9.5.0 |
| CVE-2026-8327 | 4.3 | May 21 | Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. Affected: 5 through 9.5.0 |
| CVE-2026-7881 | 4.3 | May 21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block Affected: 5.0 before 9.5.0 |
| CVE-2026-8236 | 4.3 | May 21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID} Affected: 5 through 9.5.0 |