Login Request a demo
CO
Vendor
Concretecms
1 product with CVEs on record
198
CVEs
0
On KEV
0
New 30D
Products
CC
Concrete Cms
Concretecms
9.8
198 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-18120
CC
Concrete Cms
Concretecms
5.9
0%
Sep 16Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data
CVE-2026-85387
CC
Concrete Cms
Concretecms
7.1
0%
Sep 16Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
CVE-2026-87031
CC
Concrete Cms
Concretecms
2.7
0%
Sep 16Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation
CVE-2026-87028
CC
Concrete Cms
Concretecms
6.5
0%
Sep 16Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields
CVE-2026-85386
CC
Concrete Cms
Concretecms
6.1
0%
Sep 16Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block
CVE-2026-85385
CC
Concrete Cms
Concretecms
9.6
1%
Sep 16Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
CVE-2026-81927
CC
Concrete Cms
Concretecms
5.4
0%
Sep 15Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
CVE-2026-18426
CC
Concrete Cms
Concretecms
6.5
0%
Sep 15Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit
CVE-2026-81926
CC
Concrete Cms
Concretecms
6.1
0%
Sep 15Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog
CVE-2026-81925
CC
Concrete Cms
Concretecms
6.1
0%
Sep 15Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
CVE-2026-18425
CC
Concrete Cms
Concretecms
2.7
0%
Sep 15IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages
CVE-2026-18424
CC
Concrete Cms
Concretecms
7.1
0%
Sep 15Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports
CVE-2026-18423
CC
Concrete Cms
Concretecms
7.1
0%
Sep 15Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres
CVE-2026-18422
CC
Concrete Cms
Concretecms
6.5
0%
Sep 15Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation
CVE-2026-81924
CC
Concrete Cms
Concretecms
6.5
0%
Sep 15Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation
CVE-2026-81923
CC
Concrete Cms
Concretecms
2.7
0%
Sep 15Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor
CVE-2026-81922
CC
Concrete Cms
Concretecms
2.7
0%
Sep 15"In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "
CVE-2026-81921
CC
Concrete Cms
Concretecms
5.4
0%
Sep 15In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status
CVE-2026-81920
CC
Concrete Cms
Concretecms
4.3
0%
Sep 15Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint
CVE-2026-81919
CC
Concrete Cms
Concretecms
4.3
0%
Sep 15Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint
CVE-2026-81897
CC
Concrete Cms
Concretecms
5.4
0%
Sep 15Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control
CVE-2026-81896
CC
Concrete Cms
Concretecms
5.4
0%
Sep 15Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label
CVE-2026-18111
CC
Concrete Cms
Concretecms
6.1
0%
Sep 15Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification
CVE-2026-81895
CC
Concrete Cms
Concretecms
7.2
1%
Sep 15Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`
CVE-2026-81894
CC
Concrete Cms
Concretecms
5.4
0%
Sep 15Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field
CVE-2026-18110
CC
Concrete Cms
Concretecms
7.5
2%
Sep 15Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
CVE-2026-81900
CC
Concrete Cms
Concretecms
6.1
0%
Sep 14Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)
CVE-2026-18116
CC
Concrete Cms
Concretecms
6.1
0%
Sep 14Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
CVE-2026-18117
CC
Concrete Cms
Concretecms
5.4
0%
Sep 14Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
CVE-2026-81901
CC
Concrete Cms
Concretecms
8.7
0%
Sep 14Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint
CVE-2026-81902
CC
Concrete Cms
Concretecms
8.1
0%
Sep 14Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
CVE-2026-81903
CC
Concrete Cms
Concretecms
5.4
0%
Sep 14Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon
CVE-2026-18119
CC
Concrete Cms
Concretecms
9.0
0%
Sep 14Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
CVE-2026-81907
CC
Concrete Cms
Concretecms
7.1
0%
Sep 11Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records
CVE-2026-81918
CC
Concrete Cms
Concretecms
4.8
0%
Sep 11Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
CVE-2026-81917
CC
Concrete Cms
Concretecms
5.4
0%
Sep 11Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
CVE-2026-68535
CC
Concrete Cms
Concretecms
4.3
0%
Sep 11Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions
CVE-2026-81916
CC
Concrete Cms
Concretecms
4.3
0%
Sep 11Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object
CVE-2026-81915
CC
Concrete Cms
Concretecms
5.3
0%
Sep 11In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
CVE-2026-68526
CC
Concrete Cms
Concretecms
4.3
0%
Sep 11Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
CVE-2026-81913
CC
Concrete Cms
Concretecms
6.1
0%
Sep 11Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
CVE-2026-81912
CC
Concrete Cms
Concretecms
5.7
0%
Sep 11Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
CVE-2026-81911
CC
Concrete Cms
Concretecms
5.4
0%
Sep 11Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
CVE-2026-81910
CC
Concrete Cms
Concretecms
6.5
0%
Sep 11Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values
CVE-2026-8353
CC
Concrete Cms
Concretecms
4.8
0%
May 22Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme
CVE-2026-8347
CC
Concrete Cms
Concretecms
4.3
0%
May 22Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog
CVE-2026-8340
CC
Concrete Cms
Concretecms
4.3
0%
May 22Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion
CVE-2026-8139
CC
Concrete Cms
Concretecms
5.4
0%
May 21Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName
CVE-2026-7890
CC
Concrete Cms
Concretecms
6.4
0%
May 21Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block
CVE-2026-8409
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
CVE-2026-8410
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
CVE-2026-8411
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
CVE-2026-8412
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
CVE-2026-8413
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
CVE-2026-8414
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
CVE-2026-8415
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder
CVE-2026-8416
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
CVE-2026-8427
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)
CVE-2026-8432
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()
CVE-2026-8433
CC
Concrete Cms
Concretecms
8.8
0%
May 21Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()