Concrete Cms
Monthly
Stored cross-site scripting via authorization bypass in Concrete CMS 9.2.0-9.5.2 allows an authenticated content editor to inject persistent JavaScript into the HTML head element of every page served by the site. The REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) enforces only basic content-editing authorization, omitting checks for page-property, page-template, and page-type changes; the `header_extra_content` attribute is rendered unescaped site-wide. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the stored XSS payload targets all visitors including privileged reviewers, enabling session hijacking and effective privilege escalation in multi-user editorial deployments.
Missing CSRF token validation on the orphaned block removal action (`removeOrphanedBlocks`) in Concrete CMS 9.0.0 through 9.5.2 enables remote attackers to permanently destroy all block content on any page the victim can edit. By tricking an authenticated editor into loading a crafted URL, an attacker triggers deletion of every block on the targeted page's current version; blocks not aliased elsewhere are additionally purged from the global Blocks table and their block-type data tables, making the destruction irreversible without a database backup. No public exploit code identified at time of analysis; the Concrete CMS security team assigned a CVSS 4.0 score of 7.1 reflecting high integrity impact gated on one user interaction.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a low-privileged user with delegated access to the Page Containers dashboard to inject malicious script via a crafted container icon value that breaks out of an img src attribute due to missing output encoding. The payload persists in the database and executes in the authenticated session of any administrator or editor who subsequently views the Containers dashboard list or editor views, enabling session token theft and unauthorized privileged CMS actions. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vendor released a fix in version 9.5.3.
Stored cross-site scripting in Concrete CMS versions 5.0.0 through 9.5.2 lets an editor-level account inject unsanitized custom style values through the Block Design dialog, which are then written into page CSS via a DOM sink and execute in the browser of any higher-privileged user who views the affected page. Because the payload runs in an administrator's session, an editor can hijack the admin session and escalate to full administrative control of the site. No public exploit code or in-the-wild exploitation is identified at time of analysis (SSVC Exploitation: none; not listed in CISA KEV), and the vendor-rated CVSS v4.0 score is 7.0 with a passive user-interaction requirement (UI:P).
PHP object injection in Concrete CMS versions below 9.5.2 allows authenticated high-privileged attackers to trigger arbitrary PHP object instantiation through unsafe unserialize() calls in the Workflow, Form block, and File/Set components. The vulnerability requires a malicious serialized payload to be placed in the database beforehand, and no public exploit identified at time of analysis. The vendor scored this 8.4 (CVSS 4.0), and CISA SSVC indicates no observed exploitation but total technical impact if successfully chained.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator's browser into triggering a core CMS upgrade to an attacker-chosen version. The dashboard's do_update() controller emits a CSRF token in the rendered POST form but never calls $this->token->validate('do_update'), leaving the update workflow effectively unauthenticated against forged cross-origin requests. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Concrete CMS 9.5.0 and earlier is achievable through a CSRF flaw in the /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID> endpoint, which fails to validate anti-CSRF tokens. An attacker who controls a marketplace package matching an item ID already installed on the victim site can overwrite package PHP files and trigger the upgrade() method via a single navigation by a privileged admin, resulting in code execution as the web server user. No public exploit identified at time of analysis, though the vendor (Concrete CMS security team) has acknowledged and rated the issue at CVSS 4.0 7.5.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator with canInstallPackages permission into installing an attacker-controlled package, resulting in remote code execution as the web server user. The flaw resides in the install_package() method of the dashboard's extend/install.php controller, which lacks CSRF token validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in Concrete CMS 9.5.0 and earlier allows authenticated users with access to the bulk user assignment dashboard to add arbitrary accounts to the Administrators group and remove existing admins, effectively hijacking site control. The flaw stems from missing authorization checks in bulk_user_assignment.php and was disclosed with a vendor-assigned CVSS v4.0 score of 7.5. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.
Stored cross-site scripting in Concrete CMS 9.5.0 and earlier allows authenticated editors to inject persistent JavaScript via the unvalidated 'height' parameter, executing in any subsequent visitor's browser. The CVSS 4.0 score of 7.3 reflects high privilege requirements (editor role) combined with high impact, and no public exploit identified at time of analysis.
Stored cross-site scripting in Concrete CMS 9.5.0 and earlier allows a high-privileged admin to inject arbitrary HTML/JavaScript into the OAuth authorize template via the integration name field. The flaw arises because the integration name is wrapped in <strong> tags by PHP string interpolation before being passed to the t() translation helper, causing the resulting raw HTML to be rendered when end users view the OAuth consent screen. No public exploit identified at time of analysis, but a rogue or compromised admin could potentially harvest OAuth login submissions from victims.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce authenticated administrators into downloading arbitrary marketplace packages to the server's DIR_PACKAGES directory by luring them to a crafted page that triggers the unprotected /dashboard/extend/install/download/<remoteId> GET endpoint. The vendor assigned CVSS 4.0 of 7.5 reflecting high impact on confidentiality, integrity, and availability, though no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator into triggering arbitrary package upgrades by luring them to a malicious page that issues a single GET to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() handler only checks the canInstallPackages() permission and omits CSRF token validation on this state-changing route, so a cross-site navigation is sufficient to invoke upgradeCoreData() and the package controller's upgrade() routine. No public exploit identified at time of analysis and no CISA KEV listing; EPSS not provided.
Remote code execution in Concrete CMS versions 5.0 through 9.5.0 allows a high-privileged administrator to bypass the platform's `_fromCIF` deserialization guard by submitting malicious payloads through the REST API instead of standard form POST requests. The flaw resides in the ExpressEntryList block controller (CWE-502) and stores a serialized PHP gadget in the `filterFields` database column, which is unmarshalled when another administrator subsequently views or edits the block, leading to full server takeover. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.
Authenticated remote code execution in Concrete CMS 9.5.0 and earlier allows an administrator with composer form editing privileges to chain a path traversal flaw in the ptComposerFormLayoutSetControlCustomTemplate field with the platform's permissive file uploader to execute arbitrary PHP on the server. The vendor scored this 9.4 (CVSS v4.0) reflecting high confidentiality, integrity, and availability impact across both the vulnerable component and downstream subsequent systems. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote code execution in Concrete CMS prior to version 9.4.8 stems from unsafe deserialization of PHP objects in the Express Entry List block configuration. An authenticated administrator can inject malicious serialized data through the columns parameter that executes arbitrary code when unserialized without validation. This allows attackers with admin privileges to achieve complete system compromise through stored object injection attacks.
CSRF in Concrete CMS 9.5.2 and below allows a remote unauthenticated attacker to permanently delete all entries of an Express entity by tricking an authenticated administrator into visiting an attacker-controlled page. The root flaw is that the delete_entries controller records a CSRF token mismatch but proceeds with the destructive operation anyway, making the protection entirely non-functional. The default Contact Express object ships with a fixed, predictable entity UUID, so attackers can target that data store without any prior dashboard access.
Stored cross-site scripting in Concrete CMS versions below 9.5.3 allows an authenticated user with edit_page_contents permissions to inject malicious script payloads via the Date Format field in the Page Attribute Display block. Any site visitor who subsequently loads a page containing the poisoned block will execute the attacker's script in their browser, enabling session-token theft or malicious redirects. A vendor-released patch is available (9.5.3), no public exploit has been identified, and no CISA KEV listing exists at time of analysis.
Stored cross-site scripting in Concrete CMS below 9.5.3 allows an authenticated user holding file-property edit permissions to inject persistent script payloads via the Document Library block's description and tags fields, executing against any visitor - including unauthenticated users - who loads a page rendering those columns. The block controller returned description and tags values without the h() output-escaping helper already applied to the title column, and the view template wrote these raw values directly into the HTML results table. Successful exploitation can result in session token theft or unauthorized browser-side actions against visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in Concrete CMS 9.2.0-9.5.2 allows authenticated editors holding block-add scope to bypass file-manager visibility controls by exploiting the Area API's block-create endpoint, which never invokes the block type controller's validate() method. For file-referencing block types such as hero_image and gallery, this validate() call is the sole enforcement point for file access authorization - its omission means a restricted file reference can be stored and rendered on any page. The unauthorized file's URL and thumbnail preview are then disclosed to both the submitting editor and all page visitors, with the severity of that disclosure dependent on whether public or private file storage is configured. No public exploit has been identified at time of analysis.
Missing object-level authorization in Concrete CMS below 9.5.3 allows a signed-in dashboard user with limited Page Type editing rights to modify arbitrary Page Types outside their assigned permission boundary. The Types::submit() controller accepts a user-supplied ptID parameter and persists the targeted Page Type without invoking canEditPageType(), meaning the CSRF token validation - which is action- and user-scoped only - provides no object-level constraint. No public exploit or active exploitation has been identified; the vendor self-reported this as a moderate integrity issue (CVSS 4.0: 5.1) and patched it in version 9.5.3.
Missing CSRF token validation in Concrete CMS before 9.5.3 allows a remote attacker to trick an authenticated calendar editor into silently creating unwanted duplicate events. The vulnerable endpoint - the Calendar event duplicate dialog's submit() action in concrete/controllers/dialog/event/duplicate.php - enforced only object-level permissions (canAccess() and canAddCalendarEvent()) without verifying an anti-CSRF synchronizer token, meaning any forged cross-site request submitted on behalf of a legitimate session could produce spurious CalendarEvent and CalendarEventVersions database records. No public exploit or active exploitation has been identified; the vendor-assigned CVSS 4.0 score of 5.3 reflects the bounded, integrity-only impact.
Open redirect in Concrete CMS 9.5.0-9.5.2 allows an unauthenticated attacker to craft a legitimate-looking URL on the victim site that silently forwards an authenticated user to an arbitrary external domain immediately after login or registration. The vulnerability targets the newly introduced `rcURL` parameter in the authentication and registration flows, making it uniquely scoped to the 9.5.x minor release line. Exploitation facilitates phishing and credential harvesting by abusing the implicit trust users place in a URL belonging to a known, legitimate domain. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in Concrete CMS before 9.5.3 allows an attacker to silently relocate user group tree nodes on behalf of an authenticated administrator, exploiting the missing action-token validation on the dashboard/users/groups/bulkupdate/confirm() endpoint. Because Concrete CMS inherits parent-group permissions down to child-group members, a forged group move can silently expand the authorization scope of affected users, granting access to restricted content areas without any administrator awareness. No public exploit has been identified at time of analysis; the vendor released a fix in version 9.5.3.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a user with board-editing permissions to inject arbitrary JavaScript into the description field of a summary object via the Board Custom Slot's `save_template` endpoint, which accepts the raw client-supplied `selectedTemplateOption[collection]` parameter without server-side validation or sanitization. The default summary template renders the description field without output encoding, so the stored payload fires in the browser of every subsequent visitor to the affected board slot - including unauthenticated front-end users and dashboard administrators. Successful exploitation enables session hijacking or forced CSRF actions, potentially escalating to full administrative compromise. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Missing authorization in the block alias route of Concrete CMS 9.x through 9.5.2 allows an authenticated editor holding only a limited area-scoped add_block_to_area delegation to read and permanently destroy arbitrary block content across the entire site. The vulnerable method Process::alias() in concrete/controllers/backend/block/process.php accepts caller-supplied block IDs without verifying ownership over the source block or confirming it is genuinely orphaned on the caller's page, enabling cross-page content theft via duplication and forced silent deletion of the original. No active exploitation has been confirmed in CISA KEV and no public exploit code exists, but the attack is mechanically straightforward for any qualifying editor account.
Stored cross-site scripting in Concrete CMS's RSS Displayer block (versions below 9.5.3) allows an external attacker who controls a syndicated feed to inject arbitrary JavaScript into any page that renders that feed, executing in the site origin for all visitors including authenticated administrators. The attack requires no account on the vulnerable site; the malicious payload persists across all page loads until the feed content changes or the block is removed. Concrete CMS assigned a CVSS 4.0 score of 6.0 reflecting high attack complexity, and no public exploit has been identified at time of analysis.
Missing per-entry authorization in Concrete CMS 9.2.0-9.5.2 allows any low-privileged OAuth token holder to enumerate Express entries they are not permitted to view via the REST API collection endpoint. The Express entry list endpoint omitted the per-entry view permission check, so a token with read scope for an Express entity returns restricted records including identifiers, URLs, labels, dates, and any custom attribute or associated-entry data requested through the includes parameter. The issue is fixed in 9.5.3; no public exploit has been identified and it is not listed in CISA KEV.
Unauthorized group enumeration in Concrete CMS 9.2.0 through 9.5.2 exposes the full organizational group structure to any authenticated API user holding a groups:read token. The root cause is a permission-checker callback in the REST API Groups controller that unconditionally returns true, eliminating per-object (tree-node) authorization on the group collection endpoint. With authentication required and no public exploit identified, the practical blast radius is limited to insiders or compromised API accounts, but the disclosed group hierarchy can materially assist privilege-escalation reconnaissance on affected sites.
Concrete CMS versions prior to 9.5.3 allow deactivated or email-unvalidated users to bypass account-status enforcement by authenticating through the OAuth callback path. When a user whose account has been deactivated or whose email address has not been verified holds an existing OAuth provider binding, the CMS completes the OAuth handshake, records a login event, and issues a fully-authenticated session without verifying whether the account is permitted to log in. No public exploit has been identified at time of analysis; the vendor (Concrete CMS security team) assigned a CVSS 4.0 score of 6.3 reflecting the constrained attack preconditions.
Hash type confusion in Concrete CMS (below 9.5.3) allows cross-purpose token redemption: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to take over an account, or a password-reset hash can activate an unverified account. This is an amplifier vulnerability - exploitation requires the attacker to first acquire a valid hash through a separate channel such as email interception, log exposure, or SSRF against an internal mail relay, making it a force-multiplier for hash disclosure rather than a standalone attack path. No public exploit is identified and the vendor-assigned CVSS 4.0 score of 6.3 with AC:H and AT:P reflects the conditional nature of exploitation.
Unauthenticated event metadata disclosure in Concrete CMS 9.5.2 and earlier allows any visitor to enumerate private calendar event details via a sequential IDOR on the frontend lightbox endpoint. The controller at /ccm/calendar/view_event/{bID}/{occurrence_id} loads occurrence records directly from attacker-supplied integer IDs without verifying that the occurrence belongs to the calendar block referenced by bID or that the caller holds read permission on the owning calendar. This enables systematic disclosure of event titles, dates, descriptions, page links, and configured attributes across all calendars on the installation, including those intended to be access-restricted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site request forgery in Concrete CMS 9.x through 9.5.2 allows an unauthenticated attacker to forge board-content modifications on behalf of any authenticated user who holds board-edit permission. The saveTemplate() action in the Boards custom slot dialog controller omits anti-CSRF token validation, permitting a crafted HTTP request to write attacker-controlled slot and template data to a board under the victim's authority. No public exploit has been identified at time of analysis, and the vendor has released version 9.5.3 as the fix.
Calendar event authorization in Concrete CMS 8.3.0-9.5.2 is bypassed because the event edit dialog validates the actor's permissions against a calendar identifier supplied in the HTTP request rather than the calendar that actually owns the targeted event occurrence. An authenticated user holding 'Add Event' rights on any single calendar can read and overwrite events across all other calendars in the installation, and delete individual event occurrences; publishing the injected version as the live-approved revision additionally requires approve_calendar_event workflow rights or an auto-approving workflow. Vendor-released patch is available in version 9.5.3; no public exploit has been identified at time of analysis.
Stored XSS in Concrete CMS 9.0 through 9.5.0 enables a rogue editor to inject persistent JavaScript via the page name field within the Atomik theme, executing in the browser session of any authenticated user who visits the affected pages. Consequences include session hijacking, credential theft, and unauthorized actions performed as the victim - potentially escalating to higher privileges if an administrator is targeted. No active exploitation is confirmed (SSVC: none; EPSS 0.04% at the 13th percentile), and a vendor-released patch is available in version 9.5.1.
Concrete CMS 9.5.0 and earlier exposes an IDOR combined with an incorrect authorization level check in the Express association Reorder dialog, enabling authenticated users with only view-only permission to tamper with entity ordering state for entries they do not own. The flaw is limited to sites actively using the Concrete CMS Express application-builder feature with entity ordering configured - a non-default deployment subset. No public exploit or active exploitation has been identified; all available signals (CVSS 4.0 of 2.3, EPSS at 0.04%, SSVC exploitation: none) consistently characterize this as a low-priority, narrow-impact finding.
CSRF in Concrete CMS 9.5.0 and below enables a network-based attacker to trick an authenticated backend editor into silently approving an unintended file version via the Backend\File::approveVersion endpoint, effectively downgrading a published file or activating an unpublished co-editor version without the victim's knowledge. Exploitation is constrained to users holding the edit_file_contents permission who can be socially engineered into visiting an attacker-controlled page while logged in. No public exploit code exists and no active exploitation has been identified; EPSS at 0.02% and SSVC Exploitation:none confirm minimal real-world urgency. Vendor patch available in version 9.5.1.
CSRF vulnerability in Concrete CMS 9.x before 9.5.0 allows a network-based attacker to trigger unauthorized log deletion by tricking an authenticated user into visiting a crafted page that silently issues a forged request to the concrete/controllers/dialog/logs/delete endpoint. The Concrete CMS security team assigned this a CVSS v4.0 score of 2.3, reflecting low integrity impact and the presence of attack prerequisites. No public exploit code has been identified and it is not listed in the CISA KEV catalog.
Stored XSS in Concrete CMS 9.5.0 and below allows a high-privileged authenticated attacker to inject malicious scripts via the cvName parameter of external-link pages, exploiting a sanitization bypass in the updateCollectionAliasExternal function. The injected payload is persisted server-side and executes in the browser of any user who subsequently views the affected page within the CMS backend. The vendor-assigned CVSS v4.0 score of 2.0 reflects constrained real-world impact: exploitation requires admin-level credentials, prerequisite attack conditions (AT:P), and passive victim interaction, with no public exploit identified at time of analysis.
Server-side request forgery in Concrete CMS 9.5.0 and earlier allows authenticated high-privileged page editors to direct the application server to fetch attacker-controlled URLs via the RSS Displayer block, with redirect-following behavior bypassing input validation to reach internal network resources. The CVSS v4.0 score of 2.1 (PR:H, AT:P) reflects that exploitation is constrained to users already holding page editor privileges and requires the RSS Displayer block to be in active use. No public exploit has been identified and this vulnerability is not listed in CISA KEV, placing it in a low real-world priority tier absent insider-threat or post-compromise scenarios.
Cross-Site Request Forgery in Concrete CMS 9.x allows an unauthenticated remote attacker to delete application logs on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerable endpoint is concrete/controllers/dialog/logs/bulk/delete, and exploitation results in low-integrity impact - specifically, destruction of audit log data. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS v4.0 score of 2.3 reflects the combination of required user interaction and the presence of attack prerequisites.
Cross-Site Request Forgery in Concrete CMS 9.x through 9.5.0 allows a remote unauthenticated attacker to trigger bulk page deletion by tricking an authenticated user into visiting a malicious web page. The vulnerable endpoint is concrete/controllers/dialog/page/bulk/delete, and exploitation results in low-integrity impact against the vulnerable system. No public exploit code has been identified at time of analysis, and the Concrete CMS security team assigned a CVSS v4.0 score of 2.3, reflecting the prerequisite of passive victim interaction and the constrained impact.
Cross-Site Request Forgery in Concrete CMS 9 allows a remote unauthenticated attacker to trigger unauthorized bulk cache operations against authenticated CMS users. The vulnerable endpoint is concrete/controllers/dialog/page/bulk/cache, which fails to validate request origin, enabling an attacker to manipulate page cache state by deceiving a logged-in user into loading a crafted page. No public exploit or active exploitation has been identified; the Concrete CMS security team rated this CVSS v4.0 2.3 (Low), reflecting limited integrity impact and the prerequisite of user interaction.
Cross-Site Request Forgery in Concrete CMS 9.x exposes the bulk page design dialog endpoint (concrete/controllers/dialog/page/bulk/design) to forged requests, allowing a network-accessible attacker to manipulate page design settings on behalf of an authenticated user who visits a malicious link. The Concrete CMS security team assigned a CVSS v4.0 score of 2.3 (Low), reflecting that exploitation requires specific attack prerequisites (AT:P) and user interaction (UI:P), with impact limited to low-severity integrity modifications on the vulnerable system. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-site request forgery in Concrete CMS 9.x before 9.5.0 permits a remote unauthenticated attacker to trigger unauthorized event duplication on behalf of an authenticated user by luring that user to an attacker-controlled page. The vulnerable endpoint is `concrete/controllers/dialog/event/duplicate`, which lacks CSRF token validation. The vendor-assigned CVSS v4.0 score of 2.3 reflects genuinely low impact - limited to a low-integrity effect on the vulnerable system - and no public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery in Concrete CMS 9.x allows a remote unauthenticated attacker to trigger unauthorized reordering of Express Object associations by tricking an authenticated user into visiting a crafted page. The vulnerability targets the endpoint concrete/controllers/dialog/express/association/reorder, with impact limited to low-severity integrity modification of the vulnerable system only. No public exploit has been identified at time of analysis, and the low CVSS v4.0 score of 2.3 reflects the combination of required user interaction, specific prerequisite conditions (AT:P), and limited data impact.
Cross-Site Request Forgery in Concrete CMS 9.x allows a remote unauthenticated attacker to forge state-changing requests against the file manager's addFavoriteFolder endpoint on behalf of an authenticated victim. Exploitation results in low-integrity impact - specifically unauthorized modification of a victim's favorite folder state - without any confidentiality or availability consequences. No public exploit has been identified at time of analysis, and the low CVSS v4.0 score of 2.3 reflects the passive user interaction requirement and constrained impact scope.
Cross-Site Request Forgery in Concrete CMS 9.x (versions prior to 9.5.0) allows a remote attacker to trigger the removeFavoriteFolder action on behalf of an authenticated CMS user by tricking them into visiting a malicious page. The affected endpoint is concrete/controllers/backend/file and the impact is limited to low-integrity modification - removal of a favorite folder. No public exploit has been identified and this vulnerability is not confirmed as actively exploited (CISA KEV). The CVSS 4.0 score of 2.3 accurately reflects the constrained, low-impact nature of the flaw.
Cross-Site Request Forgery (CSRF) in Concrete CMS 9.x before 9.5.1 allows a remote unauthenticated attacker to trigger unauthorized file-starring actions on behalf of an authenticated victim by luring them to a malicious page. The vulnerable endpoint is concrete/controllers/backend/file/star(), and successful exploitation results in a low-integrity modification of file bookmark state within the CMS. No public exploit code has been identified at time of analysis, and the Concrete CMS security team assigned this a CVSS v4.0 score of 2.3, reflecting its narrow, low-impact scope.
CSRF vulnerability in Concrete CMS 9.x exposes the backend file rescan controller at concrete/controllers/backend/file to unauthorized state-changing requests. Affecting versions 9.0 through 9.4.x (patched in 9.5.1), an unauthenticated remote attacker can trigger unintended file rescan operations against an authenticated victim's session by luring them to a malicious page. Rated CVSS v4.0 at 2.3 - limited to low integrity impact with no confidentiality or availability consequence - and no public exploit identified at time of analysis.
Cross-Site Request Forgery (CSRF) in Concrete CMS 9.x through 9.5.0 allows a remote unauthenticated attacker to trigger unauthorized file rescanning via the rescanMultiple() function in the backend file controller, provided a logged-in user can be lured to interact with an attacker-crafted page. The integrity impact is limited to the vulnerable component, with no confidentiality or availability consequence. No public exploit or active exploitation has been identified; the Concrete CMS security team assigned a CVSS v4.0 score of 2.3, reflecting the low real-world impact and the prerequisite of user interaction and specific attack conditions.
Cross-Site Request Forgery in Concrete CMS versions 9.0 through 9.5.0 exposes the approveVersion() backend file management endpoint to forged requests, allowing an unauthenticated remote attacker to manipulate file version approval state on behalf of an authenticated victim. The vendor's own CVSS v4.0 scoring assigns a 2.3 (Very Low) severity, reflecting the constrained impact - limited to low integrity change within the vulnerable component with no confidentiality or availability consequence. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, positioning this as a low-priority but legitimately tracked integrity weakness in CMS file workflows.
OAuth 2.0 Authorization Code handler in Concrete CMS 9.5.0 and earlier fails to enforce account status checks, allowing users with suspended, banned, or terminated accounts (uIsActive=0) to complete OAuth flows and receive valid API tokens. Deployments using OAuth 2.0 as an authentication mechanism are affected, with the primary real-world impact being unauthorized continued access by deprovisioned users - such as terminated employees or revoked contractors - who retain OAuth credentials. With a CVSS v4.0 score of 2.3, no CISA KEV listing, and no public exploit identified at time of analysis, this is a low-severity issue with narrow scope but meaningful identity governance implications for organizations relying on CMS-level account suspension as a deprovisioning control.
Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and below allows authenticated users with conversation posting rights to bypass the file permission system and reference arbitrary files from the CMS file manager. The AddMessage and UpdateMessage conversation controllers accept user-supplied integer attachment IDs and load file objects directly via the ORM without invoking the canViewFile() permission check, enabling unauthorized read and limited write access to files across the system. No public exploit code has been identified at time of analysis, and the ConcreteCMS security team assessed this as a low-severity issue (CVSS 4.0: 2.3), but sites storing sensitive private files are at meaningful risk if those files are served from within the webroot.
Unauthorized file deletion is possible in Concrete CMS 9.5.0 and below due to an inverted CSRF token validation logic in the DeleteFile controller, where the protection mechanism operates in reverse - rejecting legitimate requests and approving forged ones. A remote unauthenticated attacker (PR:N per CVSS v4.0) can craft a cross-site request forgery attack that deletes files on behalf of any victim authenticated with conversation message editing privileges. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; the vendor-assigned CVSS v4.0 score of 2.3 reflects the constrained real-world impact given the required victim privilege level and mandatory user interaction.
Unauthorized disclosure of restricted calendar event details in Concrete CMS 9.5.0 and below stems from a missing authorization check in the Calendar Block's action_get_events handler, which never invokes canView on the target calendar before returning event data. Unauthenticated remote attackers who can reach the endpoint can retrieve event information that site administrators have explicitly restricted, provided a Calendar Block with access-controlled events is deployed. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; however, the network-accessible, zero-authentication nature of the endpoint lowers the bar for casual enumeration of restricted scheduling data.
Cross-calendar data disclosure in Concrete CMS 9.5.0 and below exposes private calendar event data to unauthenticated remote attackers via an authorization bypass (CWE-639) in the Calendar Event Frontend Dialog. A publicly accessible calendar block serves as a required pivot point, allowing attackers to reference and retrieve event data from private calendars within the same installation. No public exploit has been identified at time of analysis; the vendor assigned a CVSS 4.0 score of 6.3, reflecting constrained confidentiality impact and a prerequisite attack condition (AT:P).
Unauthenticated file usage disclosure in Concrete CMS 9.5.0 and below exposes internal page structure to any network-accessible visitor without credentials. The usage controller endpoint `/ccm/system/dialogs/file/usage/{fID}` lacks a permission check, returning page IDs, URL handles, and full URLs for every page referencing a given file - including pages explicitly restricted by CMS access controls. No public exploit identified at time of analysis, but the CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N vector confirms trivial, unauthenticated network exploitation with no complexity barrier.
Concrete CMS versions below 9.5.0 expose authenticated users to two related privilege-abuse primitives via a mass assignment flaw: password replacement without the current password, and disabling per-user IP-pinning that guards against session hijacking. The user-profile edit controller forwards the entire raw POST body to UserInfo::update() with no field whitelist, allowing any registered user to inject arbitrary model attributes - including the password field and session-security settings - into their own profile update. No public exploit code has been identified at time of analysis, but the attack is low-complexity and network-accessible for any authenticated user.
Reflected XSS in Concrete CMS 9.5.0 and below allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of an authenticated admin or report viewer who clicks a crafted URL targeting the legacy form reports dashboard. The vulnerable component, Concrete\Core\Legacy\Pagination, raw-interpolates a user-controlled URL value directly into an HTML href attribute, enabling attribute injection per CWE-83. With a CVSS 4.0 score of 6.0 and high confidentiality impact (VC:H) on the vulnerable system, successful exploitation can lead to session token theft; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in Concrete CMS versions up to and including 9.5.0 enables unauthenticated remote attackers to cast fraudulent votes in restricted private surveys by submitting a private survey's optionID through the publicly accessible voting endpoint. The vulnerability is configuration-dependent - exploitation requires the target site to simultaneously host both public and private surveys - which the CVSS v4.0 vector encodes as AT:P (Attack Requirements: Present), moderately lowering the practical risk surface compared to a universally exploitable flaw. No public exploit code or active exploitation has been identified at time of analysis. Impact is limited to integrity: survey result manipulation with no confidentiality or availability consequence.
Unauthenticated page metadata disclosure in Concrete CMS 9.5.0 and below exposes private, draft, and restricted page details - including title, URL path, description, and author - to any remote attacker on sites with summary templates configured. The flaw stems from improper access control (CWE-284) where the summary template rendering pipeline bypasses page visibility restrictions entirely, making sensitive page structure visible without any credential. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; the CVSS v4.0 score of 6.3 with AT:P reflects that exploitation depends on a non-universal template configuration being present.
Unauthorized access to all Express form submissions is possible in Concrete CMS 9.5.0 and below through an Insecure Direct Object Reference (IDOR) in the Express Entry Detail block, exploitable by unauthenticated remote attackers who manipulate the exEntryID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though the AT:P metric indicates a specific deployment precondition - the Express Entry Detail block must be in active use. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in the 9.5.1 release.
Unauthorized file download in Concrete CMS 9.5.0 and below exposes permission-restricted files via a broken authorization check in the file download controller. The submit_password() method in download_file.php processes file access without enforcing the view_file permission gate, producing two exploitable paths: any unauthenticated network actor can retrieve files that carry no password protection, and any actor who possesses a file's password can retrieve that file regardless of whether their account holds view_file permission. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and earlier exposes the full content of any conversation message through an unauthenticated frontend API endpoint, including messages from restricted pages, member-only areas, and the moderation queue. Unauthenticated remote attackers can enumerate message records and harvest file attachment download URLs by querying `/ccm/frontend/conversations/message_page` without credentials. No public exploit code has been identified and no CISA KEV listing exists; however, the network-accessible unauthenticated attack vector (PR:N, AV:N) makes patching a priority for any public-facing installation using the Conversations feature.
Unauthenticated information disclosure in Concrete CMS 9.5.0 and earlier allows remote attackers to enumerate all conversation messages - including content from restricted pages, member-only areas, and the moderation queue - by exploiting a missing authorization check on the `/ccm/frontend/conversations/message_detail` endpoint. File attachment download URLs are also exposed, compounding the data leakage risk. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the attack requires no credentials and no user interaction, making bulk enumeration trivial once the conversations feature is confirmed active.
Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and earlier allows unauthenticated remote attackers to enumerate arbitrary conversation message IDs via the `/ccm/frontend/conversations/get_rating` endpoint, confirming message existence and leaking rating scores. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L) indicates no authentication is required but a prerequisite condition must be met - likely the Conversations module being enabled and publicly reachable. No public exploit has been identified and this CVE is not listed in CISA KEV, placing it in the low-priority tier despite its network-accessible nature.
Unauthenticated information disclosure in Concrete CMS 9.5.0 and below allows any network-accessible attacker to enumerate internal site structure data - including page IDs, version numbers, and URL paths - by sending GET requests to the /ccm/system/dialogs/file/usage/{fID} endpoint without any credentials. The flaw combines CWE-862 (Missing Authorization) with a classic IDOR pattern on an integer file ID parameter, and is scored CVSS 4.0 at 6.3 (Medium) by the vendor with PR:N and AC:L, though the AT:P metric indicates that valid file IDs must exist for meaningful data to be returned. No public exploit code and no CISA KEV listing exist at time of analysis.
Stored XSS in Concrete CMS versions before 9.4.8 allows authenticated administrators to inject malicious scripts through the Switch Language block, affecting any site where a rogue admin account exists. Public exploit code is available for this vulnerability. A patch is available in version 9.4.8 and later.
Stored XSS in Concrete CMS Legacy Form block below version 9.4.8 allows authenticated users with form creation permissions to inject malicious JavaScript into multiple-choice question options, which executes for all users viewing the affected form. Public exploit code exists for this vulnerability. Administrators should upgrade to version 9.4.8 or later to remediate the risk of session hijacking and data theft.
Stored XSS in Concrete CMS versions before 9.4.8 allows authenticated users with page editing permissions to inject malicious scripts through the Legacy form Question field, targeting high-privilege accounts. Public exploit code exists for this vulnerability, which requires user interaction to execute. A patch is available in version 9.4.8 and later.
Concrete CMS versions below 9.4.8 contain a cross-site request forgery vulnerability in the Anti-Spam Allowlist Group Configuration that allows authenticated administrators to modify security settings without valid CSRF token validation. An attacker with administrative privileges can exploit this to bypass security controls by manipulating the group_id parameter before token verification occurs. Public exploit code exists for this vulnerability, and a patch is available.
Concrete CMS versions below 9.4.8 contain a stored XSS vulnerability in the search block where unencoded page names and content are rendered in search results, allowing authenticated administrators to inject malicious JavaScript that executes for other users. Public exploit code exists for this vulnerability, which requires high privileges and user interaction to exploit. The vulnerability affects confidentiality and integrity but not availability.
Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity.
Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting via authorization bypass in Concrete CMS 9.2.0-9.5.2 allows an authenticated content editor to inject persistent JavaScript into the HTML head element of every page served by the site. The REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) enforces only basic content-editing authorization, omitting checks for page-property, page-template, and page-type changes; the `header_extra_content` attribute is rendered unescaped site-wide. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the stored XSS payload targets all visitors including privileged reviewers, enabling session hijacking and effective privilege escalation in multi-user editorial deployments.
Missing CSRF token validation on the orphaned block removal action (`removeOrphanedBlocks`) in Concrete CMS 9.0.0 through 9.5.2 enables remote attackers to permanently destroy all block content on any page the victim can edit. By tricking an authenticated editor into loading a crafted URL, an attacker triggers deletion of every block on the targeted page's current version; blocks not aliased elsewhere are additionally purged from the global Blocks table and their block-type data tables, making the destruction irreversible without a database backup. No public exploit code identified at time of analysis; the Concrete CMS security team assigned a CVSS 4.0 score of 7.1 reflecting high integrity impact gated on one user interaction.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a low-privileged user with delegated access to the Page Containers dashboard to inject malicious script via a crafted container icon value that breaks out of an img src attribute due to missing output encoding. The payload persists in the database and executes in the authenticated session of any administrator or editor who subsequently views the Containers dashboard list or editor views, enabling session token theft and unauthorized privileged CMS actions. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vendor released a fix in version 9.5.3.
Stored cross-site scripting in Concrete CMS versions 5.0.0 through 9.5.2 lets an editor-level account inject unsanitized custom style values through the Block Design dialog, which are then written into page CSS via a DOM sink and execute in the browser of any higher-privileged user who views the affected page. Because the payload runs in an administrator's session, an editor can hijack the admin session and escalate to full administrative control of the site. No public exploit code or in-the-wild exploitation is identified at time of analysis (SSVC Exploitation: none; not listed in CISA KEV), and the vendor-rated CVSS v4.0 score is 7.0 with a passive user-interaction requirement (UI:P).
PHP object injection in Concrete CMS versions below 9.5.2 allows authenticated high-privileged attackers to trigger arbitrary PHP object instantiation through unsafe unserialize() calls in the Workflow, Form block, and File/Set components. The vulnerability requires a malicious serialized payload to be placed in the database beforehand, and no public exploit identified at time of analysis. The vendor scored this 8.4 (CVSS 4.0), and CISA SSVC indicates no observed exploitation but total technical impact if successfully chained.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator's browser into triggering a core CMS upgrade to an attacker-chosen version. The dashboard's do_update() controller emits a CSRF token in the rendered POST form but never calls $this->token->validate('do_update'), leaving the update workflow effectively unauthenticated against forged cross-origin requests. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Concrete CMS 9.5.0 and earlier is achievable through a CSRF flaw in the /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID> endpoint, which fails to validate anti-CSRF tokens. An attacker who controls a marketplace package matching an item ID already installed on the victim site can overwrite package PHP files and trigger the upgrade() method via a single navigation by a privileged admin, resulting in code execution as the web server user. No public exploit identified at time of analysis, though the vendor (Concrete CMS security team) has acknowledged and rated the issue at CVSS 4.0 7.5.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator with canInstallPackages permission into installing an attacker-controlled package, resulting in remote code execution as the web server user. The flaw resides in the install_package() method of the dashboard's extend/install.php controller, which lacks CSRF token validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in Concrete CMS 9.5.0 and earlier allows authenticated users with access to the bulk user assignment dashboard to add arbitrary accounts to the Administrators group and remove existing admins, effectively hijacking site control. The flaw stems from missing authorization checks in bulk_user_assignment.php and was disclosed with a vendor-assigned CVSS v4.0 score of 7.5. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.
Stored cross-site scripting in Concrete CMS 9.5.0 and earlier allows authenticated editors to inject persistent JavaScript via the unvalidated 'height' parameter, executing in any subsequent visitor's browser. The CVSS 4.0 score of 7.3 reflects high privilege requirements (editor role) combined with high impact, and no public exploit identified at time of analysis.
Stored cross-site scripting in Concrete CMS 9.5.0 and earlier allows a high-privileged admin to inject arbitrary HTML/JavaScript into the OAuth authorize template via the integration name field. The flaw arises because the integration name is wrapped in <strong> tags by PHP string interpolation before being passed to the t() translation helper, causing the resulting raw HTML to be rendered when end users view the OAuth consent screen. No public exploit identified at time of analysis, but a rogue or compromised admin could potentially harvest OAuth login submissions from victims.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce authenticated administrators into downloading arbitrary marketplace packages to the server's DIR_PACKAGES directory by luring them to a crafted page that triggers the unprotected /dashboard/extend/install/download/<remoteId> GET endpoint. The vendor assigned CVSS 4.0 of 7.5 reflecting high impact on confidentiality, integrity, and availability, though no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator into triggering arbitrary package upgrades by luring them to a malicious page that issues a single GET to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() handler only checks the canInstallPackages() permission and omits CSRF token validation on this state-changing route, so a cross-site navigation is sufficient to invoke upgradeCoreData() and the package controller's upgrade() routine. No public exploit identified at time of analysis and no CISA KEV listing; EPSS not provided.
Remote code execution in Concrete CMS versions 5.0 through 9.5.0 allows a high-privileged administrator to bypass the platform's `_fromCIF` deserialization guard by submitting malicious payloads through the REST API instead of standard form POST requests. The flaw resides in the ExpressEntryList block controller (CWE-502) and stores a serialized PHP gadget in the `filterFields` database column, which is unmarshalled when another administrator subsequently views or edits the block, leading to full server takeover. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.
Authenticated remote code execution in Concrete CMS 9.5.0 and earlier allows an administrator with composer form editing privileges to chain a path traversal flaw in the ptComposerFormLayoutSetControlCustomTemplate field with the platform's permissive file uploader to execute arbitrary PHP on the server. The vendor scored this 9.4 (CVSS v4.0) reflecting high confidentiality, integrity, and availability impact across both the vulnerable component and downstream subsequent systems. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote code execution in Concrete CMS prior to version 9.4.8 stems from unsafe deserialization of PHP objects in the Express Entry List block configuration. An authenticated administrator can inject malicious serialized data through the columns parameter that executes arbitrary code when unserialized without validation. This allows attackers with admin privileges to achieve complete system compromise through stored object injection attacks.
CSRF in Concrete CMS 9.5.2 and below allows a remote unauthenticated attacker to permanently delete all entries of an Express entity by tricking an authenticated administrator into visiting an attacker-controlled page. The root flaw is that the delete_entries controller records a CSRF token mismatch but proceeds with the destructive operation anyway, making the protection entirely non-functional. The default Contact Express object ships with a fixed, predictable entity UUID, so attackers can target that data store without any prior dashboard access.
Stored cross-site scripting in Concrete CMS versions below 9.5.3 allows an authenticated user with edit_page_contents permissions to inject malicious script payloads via the Date Format field in the Page Attribute Display block. Any site visitor who subsequently loads a page containing the poisoned block will execute the attacker's script in their browser, enabling session-token theft or malicious redirects. A vendor-released patch is available (9.5.3), no public exploit has been identified, and no CISA KEV listing exists at time of analysis.
Stored cross-site scripting in Concrete CMS below 9.5.3 allows an authenticated user holding file-property edit permissions to inject persistent script payloads via the Document Library block's description and tags fields, executing against any visitor - including unauthenticated users - who loads a page rendering those columns. The block controller returned description and tags values without the h() output-escaping helper already applied to the title column, and the view template wrote these raw values directly into the HTML results table. Successful exploitation can result in session token theft or unauthorized browser-side actions against visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in Concrete CMS 9.2.0-9.5.2 allows authenticated editors holding block-add scope to bypass file-manager visibility controls by exploiting the Area API's block-create endpoint, which never invokes the block type controller's validate() method. For file-referencing block types such as hero_image and gallery, this validate() call is the sole enforcement point for file access authorization - its omission means a restricted file reference can be stored and rendered on any page. The unauthorized file's URL and thumbnail preview are then disclosed to both the submitting editor and all page visitors, with the severity of that disclosure dependent on whether public or private file storage is configured. No public exploit has been identified at time of analysis.
Missing object-level authorization in Concrete CMS below 9.5.3 allows a signed-in dashboard user with limited Page Type editing rights to modify arbitrary Page Types outside their assigned permission boundary. The Types::submit() controller accepts a user-supplied ptID parameter and persists the targeted Page Type without invoking canEditPageType(), meaning the CSRF token validation - which is action- and user-scoped only - provides no object-level constraint. No public exploit or active exploitation has been identified; the vendor self-reported this as a moderate integrity issue (CVSS 4.0: 5.1) and patched it in version 9.5.3.
Missing CSRF token validation in Concrete CMS before 9.5.3 allows a remote attacker to trick an authenticated calendar editor into silently creating unwanted duplicate events. The vulnerable endpoint - the Calendar event duplicate dialog's submit() action in concrete/controllers/dialog/event/duplicate.php - enforced only object-level permissions (canAccess() and canAddCalendarEvent()) without verifying an anti-CSRF synchronizer token, meaning any forged cross-site request submitted on behalf of a legitimate session could produce spurious CalendarEvent and CalendarEventVersions database records. No public exploit or active exploitation has been identified; the vendor-assigned CVSS 4.0 score of 5.3 reflects the bounded, integrity-only impact.
Open redirect in Concrete CMS 9.5.0-9.5.2 allows an unauthenticated attacker to craft a legitimate-looking URL on the victim site that silently forwards an authenticated user to an arbitrary external domain immediately after login or registration. The vulnerability targets the newly introduced `rcURL` parameter in the authentication and registration flows, making it uniquely scoped to the 9.5.x minor release line. Exploitation facilitates phishing and credential harvesting by abusing the implicit trust users place in a URL belonging to a known, legitimate domain. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in Concrete CMS before 9.5.3 allows an attacker to silently relocate user group tree nodes on behalf of an authenticated administrator, exploiting the missing action-token validation on the dashboard/users/groups/bulkupdate/confirm() endpoint. Because Concrete CMS inherits parent-group permissions down to child-group members, a forged group move can silently expand the authorization scope of affected users, granting access to restricted content areas without any administrator awareness. No public exploit has been identified at time of analysis; the vendor released a fix in version 9.5.3.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a user with board-editing permissions to inject arbitrary JavaScript into the description field of a summary object via the Board Custom Slot's `save_template` endpoint, which accepts the raw client-supplied `selectedTemplateOption[collection]` parameter without server-side validation or sanitization. The default summary template renders the description field without output encoding, so the stored payload fires in the browser of every subsequent visitor to the affected board slot - including unauthenticated front-end users and dashboard administrators. Successful exploitation enables session hijacking or forced CSRF actions, potentially escalating to full administrative compromise. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Missing authorization in the block alias route of Concrete CMS 9.x through 9.5.2 allows an authenticated editor holding only a limited area-scoped add_block_to_area delegation to read and permanently destroy arbitrary block content across the entire site. The vulnerable method Process::alias() in concrete/controllers/backend/block/process.php accepts caller-supplied block IDs without verifying ownership over the source block or confirming it is genuinely orphaned on the caller's page, enabling cross-page content theft via duplication and forced silent deletion of the original. No active exploitation has been confirmed in CISA KEV and no public exploit code exists, but the attack is mechanically straightforward for any qualifying editor account.
Stored cross-site scripting in Concrete CMS's RSS Displayer block (versions below 9.5.3) allows an external attacker who controls a syndicated feed to inject arbitrary JavaScript into any page that renders that feed, executing in the site origin for all visitors including authenticated administrators. The attack requires no account on the vulnerable site; the malicious payload persists across all page loads until the feed content changes or the block is removed. Concrete CMS assigned a CVSS 4.0 score of 6.0 reflecting high attack complexity, and no public exploit has been identified at time of analysis.
Missing per-entry authorization in Concrete CMS 9.2.0-9.5.2 allows any low-privileged OAuth token holder to enumerate Express entries they are not permitted to view via the REST API collection endpoint. The Express entry list endpoint omitted the per-entry view permission check, so a token with read scope for an Express entity returns restricted records including identifiers, URLs, labels, dates, and any custom attribute or associated-entry data requested through the includes parameter. The issue is fixed in 9.5.3; no public exploit has been identified and it is not listed in CISA KEV.
Unauthorized group enumeration in Concrete CMS 9.2.0 through 9.5.2 exposes the full organizational group structure to any authenticated API user holding a groups:read token. The root cause is a permission-checker callback in the REST API Groups controller that unconditionally returns true, eliminating per-object (tree-node) authorization on the group collection endpoint. With authentication required and no public exploit identified, the practical blast radius is limited to insiders or compromised API accounts, but the disclosed group hierarchy can materially assist privilege-escalation reconnaissance on affected sites.
Concrete CMS versions prior to 9.5.3 allow deactivated or email-unvalidated users to bypass account-status enforcement by authenticating through the OAuth callback path. When a user whose account has been deactivated or whose email address has not been verified holds an existing OAuth provider binding, the CMS completes the OAuth handshake, records a login event, and issues a fully-authenticated session without verifying whether the account is permitted to log in. No public exploit has been identified at time of analysis; the vendor (Concrete CMS security team) assigned a CVSS 4.0 score of 6.3 reflecting the constrained attack preconditions.
Hash type confusion in Concrete CMS (below 9.5.3) allows cross-purpose token redemption: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to take over an account, or a password-reset hash can activate an unverified account. This is an amplifier vulnerability - exploitation requires the attacker to first acquire a valid hash through a separate channel such as email interception, log exposure, or SSRF against an internal mail relay, making it a force-multiplier for hash disclosure rather than a standalone attack path. No public exploit is identified and the vendor-assigned CVSS 4.0 score of 6.3 with AC:H and AT:P reflects the conditional nature of exploitation.
Unauthenticated event metadata disclosure in Concrete CMS 9.5.2 and earlier allows any visitor to enumerate private calendar event details via a sequential IDOR on the frontend lightbox endpoint. The controller at /ccm/calendar/view_event/{bID}/{occurrence_id} loads occurrence records directly from attacker-supplied integer IDs without verifying that the occurrence belongs to the calendar block referenced by bID or that the caller holds read permission on the owning calendar. This enables systematic disclosure of event titles, dates, descriptions, page links, and configured attributes across all calendars on the installation, including those intended to be access-restricted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site request forgery in Concrete CMS 9.x through 9.5.2 allows an unauthenticated attacker to forge board-content modifications on behalf of any authenticated user who holds board-edit permission. The saveTemplate() action in the Boards custom slot dialog controller omits anti-CSRF token validation, permitting a crafted HTTP request to write attacker-controlled slot and template data to a board under the victim's authority. No public exploit has been identified at time of analysis, and the vendor has released version 9.5.3 as the fix.
Calendar event authorization in Concrete CMS 8.3.0-9.5.2 is bypassed because the event edit dialog validates the actor's permissions against a calendar identifier supplied in the HTTP request rather than the calendar that actually owns the targeted event occurrence. An authenticated user holding 'Add Event' rights on any single calendar can read and overwrite events across all other calendars in the installation, and delete individual event occurrences; publishing the injected version as the live-approved revision additionally requires approve_calendar_event workflow rights or an auto-approving workflow. Vendor-released patch is available in version 9.5.3; no public exploit has been identified at time of analysis.
Stored XSS in Concrete CMS 9.0 through 9.5.0 enables a rogue editor to inject persistent JavaScript via the page name field within the Atomik theme, executing in the browser session of any authenticated user who visits the affected pages. Consequences include session hijacking, credential theft, and unauthorized actions performed as the victim - potentially escalating to higher privileges if an administrator is targeted. No active exploitation is confirmed (SSVC: none; EPSS 0.04% at the 13th percentile), and a vendor-released patch is available in version 9.5.1.
Concrete CMS 9.5.0 and earlier exposes an IDOR combined with an incorrect authorization level check in the Express association Reorder dialog, enabling authenticated users with only view-only permission to tamper with entity ordering state for entries they do not own. The flaw is limited to sites actively using the Concrete CMS Express application-builder feature with entity ordering configured - a non-default deployment subset. No public exploit or active exploitation has been identified; all available signals (CVSS 4.0 of 2.3, EPSS at 0.04%, SSVC exploitation: none) consistently characterize this as a low-priority, narrow-impact finding.
CSRF in Concrete CMS 9.5.0 and below enables a network-based attacker to trick an authenticated backend editor into silently approving an unintended file version via the Backend\File::approveVersion endpoint, effectively downgrading a published file or activating an unpublished co-editor version without the victim's knowledge. Exploitation is constrained to users holding the edit_file_contents permission who can be socially engineered into visiting an attacker-controlled page while logged in. No public exploit code exists and no active exploitation has been identified; EPSS at 0.02% and SSVC Exploitation:none confirm minimal real-world urgency. Vendor patch available in version 9.5.1.
CSRF vulnerability in Concrete CMS 9.x before 9.5.0 allows a network-based attacker to trigger unauthorized log deletion by tricking an authenticated user into visiting a crafted page that silently issues a forged request to the concrete/controllers/dialog/logs/delete endpoint. The Concrete CMS security team assigned this a CVSS v4.0 score of 2.3, reflecting low integrity impact and the presence of attack prerequisites. No public exploit code has been identified and it is not listed in the CISA KEV catalog.
Stored XSS in Concrete CMS 9.5.0 and below allows a high-privileged authenticated attacker to inject malicious scripts via the cvName parameter of external-link pages, exploiting a sanitization bypass in the updateCollectionAliasExternal function. The injected payload is persisted server-side and executes in the browser of any user who subsequently views the affected page within the CMS backend. The vendor-assigned CVSS v4.0 score of 2.0 reflects constrained real-world impact: exploitation requires admin-level credentials, prerequisite attack conditions (AT:P), and passive victim interaction, with no public exploit identified at time of analysis.
Server-side request forgery in Concrete CMS 9.5.0 and earlier allows authenticated high-privileged page editors to direct the application server to fetch attacker-controlled URLs via the RSS Displayer block, with redirect-following behavior bypassing input validation to reach internal network resources. The CVSS v4.0 score of 2.1 (PR:H, AT:P) reflects that exploitation is constrained to users already holding page editor privileges and requires the RSS Displayer block to be in active use. No public exploit has been identified and this vulnerability is not listed in CISA KEV, placing it in a low real-world priority tier absent insider-threat or post-compromise scenarios.
Cross-Site Request Forgery in Concrete CMS 9.x allows an unauthenticated remote attacker to delete application logs on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerable endpoint is concrete/controllers/dialog/logs/bulk/delete, and exploitation results in low-integrity impact - specifically, destruction of audit log data. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS v4.0 score of 2.3 reflects the combination of required user interaction and the presence of attack prerequisites.
Cross-Site Request Forgery in Concrete CMS 9.x through 9.5.0 allows a remote unauthenticated attacker to trigger bulk page deletion by tricking an authenticated user into visiting a malicious web page. The vulnerable endpoint is concrete/controllers/dialog/page/bulk/delete, and exploitation results in low-integrity impact against the vulnerable system. No public exploit code has been identified at time of analysis, and the Concrete CMS security team assigned a CVSS v4.0 score of 2.3, reflecting the prerequisite of passive victim interaction and the constrained impact.
Cross-Site Request Forgery in Concrete CMS 9 allows a remote unauthenticated attacker to trigger unauthorized bulk cache operations against authenticated CMS users. The vulnerable endpoint is concrete/controllers/dialog/page/bulk/cache, which fails to validate request origin, enabling an attacker to manipulate page cache state by deceiving a logged-in user into loading a crafted page. No public exploit or active exploitation has been identified; the Concrete CMS security team rated this CVSS v4.0 2.3 (Low), reflecting limited integrity impact and the prerequisite of user interaction.
Cross-Site Request Forgery in Concrete CMS 9.x exposes the bulk page design dialog endpoint (concrete/controllers/dialog/page/bulk/design) to forged requests, allowing a network-accessible attacker to manipulate page design settings on behalf of an authenticated user who visits a malicious link. The Concrete CMS security team assigned a CVSS v4.0 score of 2.3 (Low), reflecting that exploitation requires specific attack prerequisites (AT:P) and user interaction (UI:P), with impact limited to low-severity integrity modifications on the vulnerable system. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-site request forgery in Concrete CMS 9.x before 9.5.0 permits a remote unauthenticated attacker to trigger unauthorized event duplication on behalf of an authenticated user by luring that user to an attacker-controlled page. The vulnerable endpoint is `concrete/controllers/dialog/event/duplicate`, which lacks CSRF token validation. The vendor-assigned CVSS v4.0 score of 2.3 reflects genuinely low impact - limited to a low-integrity effect on the vulnerable system - and no public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery in Concrete CMS 9.x allows a remote unauthenticated attacker to trigger unauthorized reordering of Express Object associations by tricking an authenticated user into visiting a crafted page. The vulnerability targets the endpoint concrete/controllers/dialog/express/association/reorder, with impact limited to low-severity integrity modification of the vulnerable system only. No public exploit has been identified at time of analysis, and the low CVSS v4.0 score of 2.3 reflects the combination of required user interaction, specific prerequisite conditions (AT:P), and limited data impact.
Cross-Site Request Forgery in Concrete CMS 9.x allows a remote unauthenticated attacker to forge state-changing requests against the file manager's addFavoriteFolder endpoint on behalf of an authenticated victim. Exploitation results in low-integrity impact - specifically unauthorized modification of a victim's favorite folder state - without any confidentiality or availability consequences. No public exploit has been identified at time of analysis, and the low CVSS v4.0 score of 2.3 reflects the passive user interaction requirement and constrained impact scope.
Cross-Site Request Forgery in Concrete CMS 9.x (versions prior to 9.5.0) allows a remote attacker to trigger the removeFavoriteFolder action on behalf of an authenticated CMS user by tricking them into visiting a malicious page. The affected endpoint is concrete/controllers/backend/file and the impact is limited to low-integrity modification - removal of a favorite folder. No public exploit has been identified and this vulnerability is not confirmed as actively exploited (CISA KEV). The CVSS 4.0 score of 2.3 accurately reflects the constrained, low-impact nature of the flaw.
Cross-Site Request Forgery (CSRF) in Concrete CMS 9.x before 9.5.1 allows a remote unauthenticated attacker to trigger unauthorized file-starring actions on behalf of an authenticated victim by luring them to a malicious page. The vulnerable endpoint is concrete/controllers/backend/file/star(), and successful exploitation results in a low-integrity modification of file bookmark state within the CMS. No public exploit code has been identified at time of analysis, and the Concrete CMS security team assigned this a CVSS v4.0 score of 2.3, reflecting its narrow, low-impact scope.
CSRF vulnerability in Concrete CMS 9.x exposes the backend file rescan controller at concrete/controllers/backend/file to unauthorized state-changing requests. Affecting versions 9.0 through 9.4.x (patched in 9.5.1), an unauthenticated remote attacker can trigger unintended file rescan operations against an authenticated victim's session by luring them to a malicious page. Rated CVSS v4.0 at 2.3 - limited to low integrity impact with no confidentiality or availability consequence - and no public exploit identified at time of analysis.
Cross-Site Request Forgery (CSRF) in Concrete CMS 9.x through 9.5.0 allows a remote unauthenticated attacker to trigger unauthorized file rescanning via the rescanMultiple() function in the backend file controller, provided a logged-in user can be lured to interact with an attacker-crafted page. The integrity impact is limited to the vulnerable component, with no confidentiality or availability consequence. No public exploit or active exploitation has been identified; the Concrete CMS security team assigned a CVSS v4.0 score of 2.3, reflecting the low real-world impact and the prerequisite of user interaction and specific attack conditions.
Cross-Site Request Forgery in Concrete CMS versions 9.0 through 9.5.0 exposes the approveVersion() backend file management endpoint to forged requests, allowing an unauthenticated remote attacker to manipulate file version approval state on behalf of an authenticated victim. The vendor's own CVSS v4.0 scoring assigns a 2.3 (Very Low) severity, reflecting the constrained impact - limited to low integrity change within the vulnerable component with no confidentiality or availability consequence. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, positioning this as a low-priority but legitimately tracked integrity weakness in CMS file workflows.
OAuth 2.0 Authorization Code handler in Concrete CMS 9.5.0 and earlier fails to enforce account status checks, allowing users with suspended, banned, or terminated accounts (uIsActive=0) to complete OAuth flows and receive valid API tokens. Deployments using OAuth 2.0 as an authentication mechanism are affected, with the primary real-world impact being unauthorized continued access by deprovisioned users - such as terminated employees or revoked contractors - who retain OAuth credentials. With a CVSS v4.0 score of 2.3, no CISA KEV listing, and no public exploit identified at time of analysis, this is a low-severity issue with narrow scope but meaningful identity governance implications for organizations relying on CMS-level account suspension as a deprovisioning control.
Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and below allows authenticated users with conversation posting rights to bypass the file permission system and reference arbitrary files from the CMS file manager. The AddMessage and UpdateMessage conversation controllers accept user-supplied integer attachment IDs and load file objects directly via the ORM without invoking the canViewFile() permission check, enabling unauthorized read and limited write access to files across the system. No public exploit code has been identified at time of analysis, and the ConcreteCMS security team assessed this as a low-severity issue (CVSS 4.0: 2.3), but sites storing sensitive private files are at meaningful risk if those files are served from within the webroot.
Unauthorized file deletion is possible in Concrete CMS 9.5.0 and below due to an inverted CSRF token validation logic in the DeleteFile controller, where the protection mechanism operates in reverse - rejecting legitimate requests and approving forged ones. A remote unauthenticated attacker (PR:N per CVSS v4.0) can craft a cross-site request forgery attack that deletes files on behalf of any victim authenticated with conversation message editing privileges. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; the vendor-assigned CVSS v4.0 score of 2.3 reflects the constrained real-world impact given the required victim privilege level and mandatory user interaction.
Unauthorized disclosure of restricted calendar event details in Concrete CMS 9.5.0 and below stems from a missing authorization check in the Calendar Block's action_get_events handler, which never invokes canView on the target calendar before returning event data. Unauthenticated remote attackers who can reach the endpoint can retrieve event information that site administrators have explicitly restricted, provided a Calendar Block with access-controlled events is deployed. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; however, the network-accessible, zero-authentication nature of the endpoint lowers the bar for casual enumeration of restricted scheduling data.
Cross-calendar data disclosure in Concrete CMS 9.5.0 and below exposes private calendar event data to unauthenticated remote attackers via an authorization bypass (CWE-639) in the Calendar Event Frontend Dialog. A publicly accessible calendar block serves as a required pivot point, allowing attackers to reference and retrieve event data from private calendars within the same installation. No public exploit has been identified at time of analysis; the vendor assigned a CVSS 4.0 score of 6.3, reflecting constrained confidentiality impact and a prerequisite attack condition (AT:P).
Unauthenticated file usage disclosure in Concrete CMS 9.5.0 and below exposes internal page structure to any network-accessible visitor without credentials. The usage controller endpoint `/ccm/system/dialogs/file/usage/{fID}` lacks a permission check, returning page IDs, URL handles, and full URLs for every page referencing a given file - including pages explicitly restricted by CMS access controls. No public exploit identified at time of analysis, but the CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N vector confirms trivial, unauthenticated network exploitation with no complexity barrier.
Concrete CMS versions below 9.5.0 expose authenticated users to two related privilege-abuse primitives via a mass assignment flaw: password replacement without the current password, and disabling per-user IP-pinning that guards against session hijacking. The user-profile edit controller forwards the entire raw POST body to UserInfo::update() with no field whitelist, allowing any registered user to inject arbitrary model attributes - including the password field and session-security settings - into their own profile update. No public exploit code has been identified at time of analysis, but the attack is low-complexity and network-accessible for any authenticated user.
Reflected XSS in Concrete CMS 9.5.0 and below allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of an authenticated admin or report viewer who clicks a crafted URL targeting the legacy form reports dashboard. The vulnerable component, Concrete\Core\Legacy\Pagination, raw-interpolates a user-controlled URL value directly into an HTML href attribute, enabling attribute injection per CWE-83. With a CVSS 4.0 score of 6.0 and high confidentiality impact (VC:H) on the vulnerable system, successful exploitation can lead to session token theft; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in Concrete CMS versions up to and including 9.5.0 enables unauthenticated remote attackers to cast fraudulent votes in restricted private surveys by submitting a private survey's optionID through the publicly accessible voting endpoint. The vulnerability is configuration-dependent - exploitation requires the target site to simultaneously host both public and private surveys - which the CVSS v4.0 vector encodes as AT:P (Attack Requirements: Present), moderately lowering the practical risk surface compared to a universally exploitable flaw. No public exploit code or active exploitation has been identified at time of analysis. Impact is limited to integrity: survey result manipulation with no confidentiality or availability consequence.
Unauthenticated page metadata disclosure in Concrete CMS 9.5.0 and below exposes private, draft, and restricted page details - including title, URL path, description, and author - to any remote attacker on sites with summary templates configured. The flaw stems from improper access control (CWE-284) where the summary template rendering pipeline bypasses page visibility restrictions entirely, making sensitive page structure visible without any credential. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; the CVSS v4.0 score of 6.3 with AT:P reflects that exploitation depends on a non-universal template configuration being present.
Unauthorized access to all Express form submissions is possible in Concrete CMS 9.5.0 and below through an Insecure Direct Object Reference (IDOR) in the Express Entry Detail block, exploitable by unauthenticated remote attackers who manipulate the exEntryID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though the AT:P metric indicates a specific deployment precondition - the Express Entry Detail block must be in active use. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in the 9.5.1 release.
Unauthorized file download in Concrete CMS 9.5.0 and below exposes permission-restricted files via a broken authorization check in the file download controller. The submit_password() method in download_file.php processes file access without enforcing the view_file permission gate, producing two exploitable paths: any unauthenticated network actor can retrieve files that carry no password protection, and any actor who possesses a file's password can retrieve that file regardless of whether their account holds view_file permission. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and earlier exposes the full content of any conversation message through an unauthenticated frontend API endpoint, including messages from restricted pages, member-only areas, and the moderation queue. Unauthenticated remote attackers can enumerate message records and harvest file attachment download URLs by querying `/ccm/frontend/conversations/message_page` without credentials. No public exploit code has been identified and no CISA KEV listing exists; however, the network-accessible unauthenticated attack vector (PR:N, AV:N) makes patching a priority for any public-facing installation using the Conversations feature.
Unauthenticated information disclosure in Concrete CMS 9.5.0 and earlier allows remote attackers to enumerate all conversation messages - including content from restricted pages, member-only areas, and the moderation queue - by exploiting a missing authorization check on the `/ccm/frontend/conversations/message_detail` endpoint. File attachment download URLs are also exposed, compounding the data leakage risk. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the attack requires no credentials and no user interaction, making bulk enumeration trivial once the conversations feature is confirmed active.
Insecure Direct Object Reference (IDOR) in Concrete CMS 9.5.0 and earlier allows unauthenticated remote attackers to enumerate arbitrary conversation message IDs via the `/ccm/frontend/conversations/get_rating` endpoint, confirming message existence and leaking rating scores. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L) indicates no authentication is required but a prerequisite condition must be met - likely the Conversations module being enabled and publicly reachable. No public exploit has been identified and this CVE is not listed in CISA KEV, placing it in the low-priority tier despite its network-accessible nature.
Unauthenticated information disclosure in Concrete CMS 9.5.0 and below allows any network-accessible attacker to enumerate internal site structure data - including page IDs, version numbers, and URL paths - by sending GET requests to the /ccm/system/dialogs/file/usage/{fID} endpoint without any credentials. The flaw combines CWE-862 (Missing Authorization) with a classic IDOR pattern on an integer file ID parameter, and is scored CVSS 4.0 at 6.3 (Medium) by the vendor with PR:N and AC:L, though the AT:P metric indicates that valid file IDs must exist for meaningful data to be returned. No public exploit code and no CISA KEV listing exist at time of analysis.
Stored XSS in Concrete CMS versions before 9.4.8 allows authenticated administrators to inject malicious scripts through the Switch Language block, affecting any site where a rogue admin account exists. Public exploit code is available for this vulnerability. A patch is available in version 9.4.8 and later.
Stored XSS in Concrete CMS Legacy Form block below version 9.4.8 allows authenticated users with form creation permissions to inject malicious JavaScript into multiple-choice question options, which executes for all users viewing the affected form. Public exploit code exists for this vulnerability. Administrators should upgrade to version 9.4.8 or later to remediate the risk of session hijacking and data theft.
Stored XSS in Concrete CMS versions before 9.4.8 allows authenticated users with page editing permissions to inject malicious scripts through the Legacy form Question field, targeting high-privilege accounts. Public exploit code exists for this vulnerability, which requires user interaction to execute. A patch is available in version 9.4.8 and later.
Concrete CMS versions below 9.4.8 contain a cross-site request forgery vulnerability in the Anti-Spam Allowlist Group Configuration that allows authenticated administrators to modify security settings without valid CSRF token validation. An attacker with administrative privileges can exploit this to bypass security controls by manipulating the group_id parameter before token verification occurs. Public exploit code exists for this vulnerability, and a patch is available.
Concrete CMS versions below 9.4.8 contain a stored XSS vulnerability in the search block where unencoded page names and content are rendered in search results, allowing authenticated administrators to inject malicious JavaScript that executes for other users. Public exploit code exists for this vulnerability, which requires high privileges and user interaction to exploit. The vulnerability affects confidentiality and integrity but not availability.
Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity.
Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.