CC
Vendor
Concrete CMS
116
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-18120 | CC Concrete CMS Concrete CMS | 5.9 | Sep 16 | Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data |
| CVE-2026-85387 | CC Concrete CMS Concrete CMS | 7.1 | Sep 16 | Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access |
| CVE-2026-87031 | CC Concrete CMS Concrete CMS | 2.7 | Sep 16 | Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation |
| CVE-2026-87028 | CC Concrete CMS Concrete CMS | 6.5 | Sep 16 | Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields |
| CVE-2026-85386 | CC Concrete CMS Concrete CMS | 6.1 | Sep 16 | Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block |
| CVE-2026-85385 | CC Concrete CMS Concrete CMS | 9.6 | Sep 16 | Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field |
| CVE-2026-81927 | CC Concrete CMS Concrete CMS | 5.4 | Sep 15 | Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode |
| CVE-2026-18426 | CC Concrete CMS Concrete CMS | 6.5 | Sep 15 | Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit |
| CVE-2026-81926 | CC Concrete CMS Concrete CMS | 6.1 | Sep 15 | Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog |
| CVE-2026-81925 | CC Concrete CMS Concrete CMS | 6.1 | Sep 15 | Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format |
| CVE-2026-18425 | CC Concrete CMS Concrete CMS | 2.7 | Sep 15 | IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages |
| CVE-2026-18424 | CC Concrete CMS Concrete CMS | 7.1 | Sep 15 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports |
| CVE-2026-18423 | CC Concrete CMS Concrete CMS | 7.1 | Sep 15 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres |
| CVE-2026-18422 | CC Concrete CMS Concrete CMS | 6.5 | Sep 15 | Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation |
| CVE-2026-18421 | CC Concrete CMS Concrete CMS | 2.1 | Sep 15 | Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control |
| CVE-2026-68529 | CC Concrete CMS Concrete CMS | 2.1 | Sep 15 | Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries |
| CVE-2026-68530 | CC Concrete CMS Concrete CMS | 2.1 | Sep 15 | Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances |
| CVE-2026-68531 | CC Concrete CMS Concrete CMS | 2.1 | Sep 15 | Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search |
| CVE-2026-81924 | CC Concrete CMS Concrete CMS | 6.5 | Sep 15 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation |
| CVE-2026-81923 | CC Concrete CMS Concrete CMS | 2.7 | Sep 15 | Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor |
| CVE-2026-81922 | CC Concrete CMS Concrete CMS | 2.7 | Sep 15 | "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages " |
| CVE-2026-81921 | CC Concrete CMS Concrete CMS | 5.4 | Sep 15 | In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status |
| CVE-2026-81920 | CC Concrete CMS Concrete CMS | 4.3 | Sep 15 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint |
| CVE-2026-68532 | CC Concrete CMS Concrete CMS | 2.3 | Sep 15 | Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action |
| CVE-2026-68533 | CC Concrete CMS Concrete CMS | 2.3 | Sep 15 | Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission |
| CVE-2026-68534 | CC Concrete CMS Concrete CMS | 2.3 | Sep 15 | Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors |
| CVE-2026-81919 | CC Concrete CMS Concrete CMS | 4.3 | Sep 15 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint |
| CVE-2026-81899 | CC Concrete CMS Concrete CMS | 7.3 | Sep 15 | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard |
| CVE-2026-18115 | CC Concrete CMS Concrete CMS | 7.4 | Sep 15 | In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover. |
| CVE-2026-18113 | CC Concrete CMS Concrete CMS | 7.5 | Sep 15 | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names |
| CVE-2026-81898 | CC Concrete CMS Concrete CMS | 7.5 | Sep 15 | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views |
| CVE-2026-81897 | CC Concrete CMS Concrete CMS | 5.4 | Sep 15 | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control |
| CVE-2026-81896 | CC Concrete CMS Concrete CMS | 5.4 | Sep 15 | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label |
| CVE-2026-18111 | CC Concrete CMS Concrete CMS | 6.1 | Sep 15 | Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification |
| CVE-2026-81895 | CC Concrete CMS Concrete CMS | 7.2 | Sep 15 | Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any` |
| CVE-2026-81894 | CC Concrete CMS Concrete CMS | 5.4 | Sep 15 | Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field |
| CVE-2026-18110 | CC Concrete CMS Concrete CMS | 7.5 | Sep 15 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username |
| CVE-2026-81900 | CC Concrete CMS Concrete CMS | 6.1 | Sep 14 | Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight) |
| CVE-2026-18116 | CC Concrete CMS Concrete CMS | 6.1 | Sep 14 | Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications |
| CVE-2026-18117 | CC Concrete CMS Concrete CMS | 5.4 | Sep 14 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name |
| CVE-2026-81901 | CC Concrete CMS Concrete CMS | 8.7 | Sep 14 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint |
| CVE-2026-81902 | CC Concrete CMS Concrete CMS | 8.1 | Sep 14 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup |
| CVE-2026-81903 | CC Concrete CMS Concrete CMS | 5.4 | Sep 14 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon |
| CVE-2026-18119 | CC Concrete CMS Concrete CMS | 9.0 | Sep 14 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values |
| CVE-2026-81907 | CC Concrete CMS Concrete CMS | 7.1 | Sep 11 | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records |
| CVE-2026-81918 | CC Concrete CMS Concrete CMS | 4.8 | Sep 11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block |
| CVE-2026-81917 | CC Concrete CMS Concrete CMS | 5.4 | Sep 11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags |
| CVE-2026-68535 | CC Concrete CMS Concrete CMS | 4.3 | Sep 11 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions |
| CVE-2026-81916 | CC Concrete CMS Concrete CMS | 4.3 | Sep 11 | Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object |
| CVE-2026-81915 | CC Concrete CMS Concrete CMS | 5.3 | Sep 11 | In Concrete CMS below 9.5.3, Page Type update omits object-level authorization |
| CVE-2026-68526 | CC Concrete CMS Concrete CMS | 4.3 | Sep 11 | Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller |
| CVE-2026-81913 | CC Concrete CMS Concrete CMS | 6.1 | Sep 11 | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. |
| CVE-2026-81912 | CC Concrete CMS Concrete CMS | 5.7 | Sep 11 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature |
| CVE-2026-81911 | CC Concrete CMS Concrete CMS | 5.4 | Sep 11 | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description |
| CVE-2026-81910 | CC Concrete CMS Concrete CMS | 6.5 | Sep 11 | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values |
| CVE-2026-81909 | CC Concrete CMS Concrete CMS | 5.9 | Sep 11 | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks |
| CVE-2026-68528 | CC Concrete CMS Concrete CMS | 6.0 | Sep 11 | Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title |
| CVE-2026-18122 | CC Concrete CMS Concrete CMS | 6.0 | Sep 11 | Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization |
| CVE-2026-81908 | CC Concrete CMS Concrete CMS | 6.0 | Sep 11 | Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups |
| CVE-2026-81906 | CC Concrete CMS Concrete CMS | 6.3 | Sep 10 | [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks |