Login Request a demo
CC
Product
Concrete Cms
by Concretecms · last CVE Sep 16, 2026
198
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities198In the news0Timeline
Severity mix
Critical 8High 46Medium 136Low 5
Severity
All severities198Critical8High46Medium136Low5
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Concrete Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-48648
9.8
1%
Nov 17
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions
Affected: before 8.5.13; 9.0 before 9.2.2
CVE-2022-21829
9.8
2%
Jun 24
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE
Affected: before 8.5.8; 9.0.0 before 9.1.0
CVE-2021-22958
9.8
1%
Oct 7
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost…
Affected: before 8.5.5
CVE-2021-40098
9.8
2%
Sep 27
An issue was discovered in Concrete CMS through 8.5.5
Affected: through 8.5.5
CVE-2026-85385
9.6
1%
Sep 16
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
Affected: before 9.5.4
CVE-2022-30117
9.1
2%
Jun 24
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit
Affected: before 8.5.8; 9.0.0 before 9.1.0
CVE-2021-40102
9.1
1%
Sep 24
An issue was discovered in Concrete CMS through 8.5.5
Affected: through 8.5.5
CVE-2026-18119
9.0
0%
Sep 14
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
Affected: before 9.5.3
Showing 8