Monthly
We need answer as JSON only. Need synthesize data. Need be careful: no arrays except data_quality_flags is JSON array. But user said every field plain string not array, but then data_quality_flags says JSON array. Contradiction? They specify return JSON object and fields all strings except data_quality_flags array. We'll output data_quality_flags as array. Need fill. Given CVE-2026-15639 description: attacker can craft malicious link that if used by legitimate user may cause user's browser to run JavaScript supplied by attacker. CVSS 9.3 with CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H. CWE-79. Reported by... Tags: XSS. References: [nvd] (None) https://delinea.com/security-advisories. So vendor Delinea likely. Product? Need identify specific product. References Delinea security advisories. CVE description generic. Product_name: "Delinea" maybe? But 1-3 words. Need product affected. Delinea is vendor. Could be Delinea Secret Server? But no product specified. "Delinea" may be product? Delinea is company (formerly ThycoticCentrify) offering PAM. CVE likely in Delinea product. References link generic. Description "malicious link ... JavaScript" is reflected XSS? CWE-79. Product name maybe "Delinea Secret Server"? Need infer? We have only Delinea. Could be "Delinea" as product_name? The instruction says NOT vendor alone. If multiple products pick primary. But no product info. Use product_name "Delinea" maybe one word, but violates "not vendor alone". Need more. Could use "Delinea Privileged Access"? But no evidence. Maybe CVE ID and advisory link. Maybe product "Delinea Platform"? Hmm. We need be accurate. The CVE data references Delinea security advisories, no specific product. Could maybe product in advisory page not given. We need not invent. Product_name can be "Delinea" as primary, but rule says specific product or service, not vendor alone. Maybe "Unknown Delinea Product"? But 1-3 words only. Use "Delinea Web UI"? Hmm. Since description
Stored cross-site scripting in Concrete CMS 9.0.0 through 9.5.2 lets an authenticated user who holds the Add Group Folder permission save a JavaScript payload as a group folder name, which the Members > Groups dashboard then renders as live markup without output encoding. When an administrator opens that dashboard page, the injected script executes in the administrator's session, enabling session and token theft plus any action the administrator can perform. The vendor assigned CVSS v4.0 7.3 (AV:N/AC:L/AT:P/PR:H/UI:P); no CISA KEV listing or public exploit code was identified in the provided data, and no EPSS score was supplied.
Stored cross-site scripting in the Concrete CMS Top Navigation Bar block (versions 9.0 through 9.5.2) allows any user who can create or rename pages to embed a script payload inside a child page name, which the block writes into the rendered navigation without HTML escaping. The payload executes in the origin of every visitor, editor, or administrator who expands the affected dropdown, letting it read same-origin content or perform actions under that victim's session. No public exploit code or CISA KEV listing was identified at time of analysis, and the vendor rates the issue 7.5 (CVSS v4.0) with PR:H, reflecting that the attacker must already hold page-management privileges.
Stored cross-site scripting in Concrete CMS versions before 9.5.3 lets any user who can submit an Address attribute inject JavaScript that later executes in the browser session of a dashboard user viewing the affected Express association entry. The root cause is a country-less text formatter for the Address attribute that skips HTML-escaping, combined with Express association templates (such as concrete/elements/express/form/view/dashboard/association.php) echoing the association label mask without calling the h() escaping helper. The vendor scored this CVSS v4.0 7.5 (AV:N/AC:L/AT:P/PR:L/UI:P) and published the fix in the 9.5.3 release notes; no CISA KEV listing or public exploit code was identified at time
Stored cross-site scripting in Concrete CMS versions before 9.5.3 lets an authenticated user with form-editing privileges plant HTML or script inside a Form block question label, which is then rendered unencoded as a column header in the Dashboard Form Submissions report. The payload fires in the browser of any administrator who opens that report for the affected form, allowing the attacker to act with the administrator's session privileges. No public exploit code or active exploitation has been identified at time of analysis; the vendor scored the issue 8.4 under CVSS 4.0 (PR:H, UI:P).
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
Stored XSS in Concrete CMS before 9.5.3 allows a user with edit_block permission to inject malicious JavaScript into a page's YouTube embed block by supplying an unsanitized iframe width or height value. Because only PHP's trim() is applied before the values are written into HTML attribute context, an attacker can persist an event-handler payload that executes in every visitor's browser - and, when the victim holds administrative privileges, the script acts with those privileges. No public exploit code or active exploitation has been identified at time of analysis; the vendor has patched the issue in version 9.5.3.
Stored XSS in Concrete CMS 8.3.0-9.5.2 permits a registered user with calendar event creation rights to inject script payloads via unsanitized event names that later execute in an administrator's browser through unescaped rendering in the dashboard "Waiting For Me" workflow notification block. Because the injected script runs under an active administrator session, an attacker can leverage it to silently create a new administrator account, achieving full CMS compromise. No active exploitation or public proof-of-concept has been identified; the vendor has released version 9.5.3 as the fix and assigned this a CVSS 4.0 score of 7.3.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows an authenticated editor to escalate privileges to administrator by injecting malicious JavaScript into the custom page alias name (customAliasName) field. The Edit Alias dialog applied only a trim() call to the submitted value with no HTML encoding or output neutralization, causing the alias to render unescaped in the administrative Sitemap panel. Any administrator or editor who subsequently opens the Sitemap panel automatically executes the stored payload, enabling session hijacking and full privilege escalation from editor to administrator. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a low-privileged user with delegated access to the Page Containers dashboard to inject malicious script via a crafted container icon value that breaks out of an img src attribute due to missing output encoding. The payload persists in the database and executes in the authenticated session of any administrator or editor who subsequently views the Containers dashboard list or editor views, enabling session token theft and unauthorized privileged CMS actions. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vendor released a fix in version 9.5.3.
We need answer as JSON only. Need synthesize data. Need be careful: no arrays except data_quality_flags is JSON array. But user said every field plain string not array, but then data_quality_flags says JSON array. Contradiction? They specify return JSON object and fields all strings except data_quality_flags array. We'll output data_quality_flags as array. Need fill. Given CVE-2026-15639 description: attacker can craft malicious link that if used by legitimate user may cause user's browser to run JavaScript supplied by attacker. CVSS 9.3 with CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H. CWE-79. Reported by... Tags: XSS. References: [nvd] (None) https://delinea.com/security-advisories. So vendor Delinea likely. Product? Need identify specific product. References Delinea security advisories. CVE description generic. Product_name: "Delinea" maybe? But 1-3 words. Need product affected. Delinea is vendor. Could be Delinea Secret Server? But no product specified. "Delinea" may be product? Delinea is company (formerly ThycoticCentrify) offering PAM. CVE likely in Delinea product. References link generic. Description "malicious link ... JavaScript" is reflected XSS? CWE-79. Product name maybe "Delinea Secret Server"? Need infer? We have only Delinea. Could be "Delinea" as product_name? The instruction says NOT vendor alone. If multiple products pick primary. But no product info. Use product_name "Delinea" maybe one word, but violates "not vendor alone". Need more. Could use "Delinea Privileged Access"? But no evidence. Maybe CVE ID and advisory link. Maybe product "Delinea Platform"? Hmm. We need be accurate. The CVE data references Delinea security advisories, no specific product. Could maybe product in advisory page not given. We need not invent. Product_name can be "Delinea" as primary, but rule says specific product or service, not vendor alone. Maybe "Unknown Delinea Product"? But 1-3 words only. Use "Delinea Web UI"? Hmm. Since description
Stored cross-site scripting in Concrete CMS 9.0.0 through 9.5.2 lets an authenticated user who holds the Add Group Folder permission save a JavaScript payload as a group folder name, which the Members > Groups dashboard then renders as live markup without output encoding. When an administrator opens that dashboard page, the injected script executes in the administrator's session, enabling session and token theft plus any action the administrator can perform. The vendor assigned CVSS v4.0 7.3 (AV:N/AC:L/AT:P/PR:H/UI:P); no CISA KEV listing or public exploit code was identified in the provided data, and no EPSS score was supplied.
Stored cross-site scripting in the Concrete CMS Top Navigation Bar block (versions 9.0 through 9.5.2) allows any user who can create or rename pages to embed a script payload inside a child page name, which the block writes into the rendered navigation without HTML escaping. The payload executes in the origin of every visitor, editor, or administrator who expands the affected dropdown, letting it read same-origin content or perform actions under that victim's session. No public exploit code or CISA KEV listing was identified at time of analysis, and the vendor rates the issue 7.5 (CVSS v4.0) with PR:H, reflecting that the attacker must already hold page-management privileges.
Stored cross-site scripting in Concrete CMS versions before 9.5.3 lets any user who can submit an Address attribute inject JavaScript that later executes in the browser session of a dashboard user viewing the affected Express association entry. The root cause is a country-less text formatter for the Address attribute that skips HTML-escaping, combined with Express association templates (such as concrete/elements/express/form/view/dashboard/association.php) echoing the association label mask without calling the h() escaping helper. The vendor scored this CVSS v4.0 7.5 (AV:N/AC:L/AT:P/PR:L/UI:P) and published the fix in the 9.5.3 release notes; no CISA KEV listing or public exploit code was identified at time
Stored cross-site scripting in Concrete CMS versions before 9.5.3 lets an authenticated user with form-editing privileges plant HTML or script inside a Form block question label, which is then rendered unencoded as a column header in the Dashboard Form Submissions report. The payload fires in the browser of any administrator who opens that report for the affected form, allowing the attacker to act with the administrator's session privileges. No public exploit code or active exploitation has been identified at time of analysis; the vendor scored the issue 8.4 under CVSS 4.0 (PR:H, UI:P).
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
Stored XSS in Concrete CMS before 9.5.3 allows a user with edit_block permission to inject malicious JavaScript into a page's YouTube embed block by supplying an unsanitized iframe width or height value. Because only PHP's trim() is applied before the values are written into HTML attribute context, an attacker can persist an event-handler payload that executes in every visitor's browser - and, when the victim holds administrative privileges, the script acts with those privileges. No public exploit code or active exploitation has been identified at time of analysis; the vendor has patched the issue in version 9.5.3.
Stored XSS in Concrete CMS 8.3.0-9.5.2 permits a registered user with calendar event creation rights to inject script payloads via unsanitized event names that later execute in an administrator's browser through unescaped rendering in the dashboard "Waiting For Me" workflow notification block. Because the injected script runs under an active administrator session, an attacker can leverage it to silently create a new administrator account, achieving full CMS compromise. No active exploitation or public proof-of-concept has been identified; the vendor has released version 9.5.3 as the fix and assigned this a CVSS 4.0 score of 7.3.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows an authenticated editor to escalate privileges to administrator by injecting malicious JavaScript into the custom page alias name (customAliasName) field. The Edit Alias dialog applied only a trim() call to the submitted value with no HTML encoding or output neutralization, causing the alias to render unescaped in the administrative Sitemap panel. Any administrator or editor who subsequently opens the Sitemap panel automatically executes the stored payload, enabling session hijacking and full privilege escalation from editor to administrator. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a low-privileged user with delegated access to the Page Containers dashboard to inject malicious script via a crafted container icon value that breaks out of an img src attribute due to missing output encoding. The payload persists in the database and executes in the authenticated session of any administrator or editor who subsequently views the Containers dashboard list or editor views, enabling session token theft and unauthorized privileged CMS actions. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vendor released a fix in version 9.5.3.