Concretecms

Concrete Cms

166 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
3.3

CVE-2023-28473

  • EPSS 0.76%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 21.11.2024 07:55:10

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.

5.4

CVE-2023-28474

  • EPSS 0.63%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 21.11.2024 07:55:10

Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.

6.1

CVE-2023-28475

  • EPSS 0.64%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 21.11.2024 07:55:10

Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

5.4

CVE-2023-28476

  • EPSS 0.54%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 21.11.2024 07:55:10

Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.

5.4

CVE-2023-28477

  • EPSS 0.58%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 21.11.2024 07:55:10

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.

5.4

CVE-2023-28819

  • EPSS 0.64%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 21.11.2024 07:56:04

Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.

5.4

CVE-2023-28820

  • EPSS 0.39%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 31.01.2025 17:15:10

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

5.3

CVE-2023-28821

  • EPSS 0.73%
  • Veröffentlicht 28.04.2023 14:15:10
  • Zuletzt bearbeitet 30.01.2025 21:15:10

Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

6.1

CVE-2022-43556

  • EPSS 0.62%
  • Veröffentlicht 05.12.2022 22:15:11
  • Zuletzt bearbeitet 24.04.2025 14:15:38

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector ...

4.8

CVE-2022-43688

  • EPSS 0.55%
  • Veröffentlicht 14.11.2022 23:15:12
  • Zuletzt bearbeitet 21.11.2024 07:27:02

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10...