concrete5/concrete5 (Packagist)
Advisories
151
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 9.5.2 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require concrete5/concrete5:^9.5.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-g82f-9pw7-773w Concrete CMS: PHP Object Injection via unserialize() calls |
High EPSS 0.15% |
< 9.5.2 | 9.5.2 |
| GHSA-52pr-7vmf-2w7x Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components |
High EPSS 0.15% |
< 9.5.2 | 9.5.2 |
| GHSA-q9fm-mpg8-8jqm Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme |
Medium EPSS 0.15% |
>= 9.0.0RC.1, < 9.5.1 | 9.5.1 |
| GHSA-jqvq-gv67-3567 Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog |
Medium EPSS 0.24% |
< 9.5.1 | 9.5.1 |
| GHSA-xjg6-5v39-v7fc Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion |
Medium EPSS 0.10% |
< 9.5.1 | 9.5.1 |
| GHSA-44q4-354f-c826 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() |
Medium EPSS 0.11% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-6qjh-p324-694f Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-6fxm-r8p3-mx5c Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-97jw-gr4m-c5v8 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-67hj-8239-cmf5 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-qj94-6rx6-27fr Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-xj25-753j-wgp9 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-98qf-jvwj-2r5f Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-mpq2-mv8p-9wm6 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-rv3q-xmfw-mcjv Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-752x-23hp-jmv6 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete |
High EPSS 0.13% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-v7c7-658v-hh7v Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete |
High EPSS 0.14% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-56c9-xq5g-xrf9 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete |
High EPSS 0.14% |
>= 9.0.0RC1, < 9.5.1 | 9.5.1 |
| GHSA-8c7c-h7px-267g Concrete CMS is vulnerable to IDOR in surveys |
Medium EPSS 0.19% |
< 9.5.1 | 9.5.1 |
| GHSA-wmw3-3fv3-h54w Concrete CMS has a session-hardening bypass and allows password change without reauthorization |
Medium EPSS 0.18% |
< 9.5.1 | 9.5.1 |
| GHSA-f73j-pm2c-rxvr Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination |
Medium EPSS 0.14% |
< 9.5.1 | 9.5.1 |
| GHSA-vpgr-cwfx-pwfw Concrete CMS is vulnerable to unauthenticated page metadata disclosure |
Medium EPSS 0.19% |
< 9.5.1 | 9.5.1 |
| GHSA-2xp7-rpvc-pjwc Concrete CMS is vulnerable to IDOR |
Medium EPSS 0.19% |
< 9.5.1 | 9.5.1 |
| GHSA-qv3x-mffx-9gw8 Concrete CMS is vulnerable to IDOR |
Medium EPSS 0.20% |
< 9.5.1 | 9.5.1 |
| GHSA-xpgc-7vc2-8725 Concrete CMS is vulnerable to IDOR |
Medium EPSS 0.64% |
< 9.5.1 | 9.5.1 |
| GHSA-58c8-vvqw-cm7m Concrete CMS is vulnerable to IDOR combined with a missing authentication gate |
Medium EPSS 0.68% |
< 9.5.1 | 9.5.1 |
| GHSA-pcrh-gj77-j4mw Concrete CMS is vulnerable to Stored XSS via external-link page cvName |
Medium EPSS 0.15% |
< 9.5.1 | 9.5.1 |
| GHSA-gjwq-9v8p-47w7 Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation |
Medium EPSS 0.15% |
< 9.5.1 | 9.5.1 |
| GHSA-f54h-78c9-c24h Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status |
Medium EPSS 0.17% |
< 9.5.1 | 9.5.1 |
| GHSA-p8p9-5953-h9jw Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage |
Medium EPSS 0.29% |
< 9.5.1 | 9.5.1 |
| GHSA-66rg-92q4-6m8q Concrete CMS is vulnerable to unauthorized file deletion |
Medium EPSS 0.12% |
< 9.5.1 | 9.5.1 |
| GHSA-chfm-cm6h-q5x7 Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block |
Medium EPSS 0.21% |
< 9.5.1 | 9.5.1 |
| GHSA-fqg3-8w8r-8g94 Concrete CMS has an unauthorized file access issue |
Medium EPSS 0.22% |
< 9.5.1 | 9.5.1 |
| GHSA-prxr-vjgc-2cq9 Concrete CMS is Vulnerable to Cross-Site Request Forgery |
High EPSS 0.13% |
< 9.5.1 | 9.5.1 |
| GHSA-5rj5-gfmr-hrc3 Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` |
High EPSS 0.17% |
< 9.5.1 | 9.5.1 |
| GHSA-4c8m-6fwx-m7xq Concrete CMS contains a CSRF vulnerability |
High EPSS 0.17% |
< 9.5.1 | 9.5.1 |
| GHSA-jr5g-qv3g-rxxx Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>` |
High EPSS 0.12% |
< 9.5.1 | 9.5.1 |
| GHSA-g7xp-jf3x-wcx4 Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php |
High EPSS 0.30% |
< 9.5.1 | 9.5.1 |
| GHSA-46xh-7854-f568 Concrete CMS is vulnerable to authorization bypass in the Calendar Block |
Medium EPSS 0.21% |
< 9.5.1 | 9.5.1 |
| GHSA-x2fp-hj8c-mmxh Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog |
Medium EPSS 0.21% |
< 9.5.1 | 9.5.1 |
| GHSA-9v2g-37mp-qpxf Concrete CMS has Stored XSS through its height parameter |
Medium EPSS 0.12% |
< 9.5.1 | 9.5.1 |
| GHSA-h72c-xx3w-w8h7 Concrete CMS is vulnerable to Stored XSS via OAuth integration name |
Medium EPSS 0.18% |
< 9.5.1 | 9.5.1 |
| GHSA-r42c-3rr2-jrfp Concrete CMS is Vulnerable to Cross-Site Request Forgery |
Medium EPSS 0.12% |
< 9.5.1 | 9.5.1 |
| GHSA-pv2v-6w2v-97x6 Concrete CMS Vulnerable to Deserialization of Untrusted Data |
High EPSS 0.47% |
< 9.5.1 | 9.5.1 |
| GHSA-645j-cm4x-3xvw Concrete CMS Vulnerable to Relative Path Traversal |
High EPSS 0.74% |
< 9.5.1 | 9.5.1 |
| GHSA-4g7q-44qp-cc5c Concrete CMS is vulnerable to unauthenticated file usage disclosure |
Medium EPSS 1.46% |
< 9.5.1 | 9.5.1 |
| GHSA-p68c-rmfh-j48h ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads |
Medium EPSS 0.30% |
<= 9.4.7 | No fix yet |
| GHSA-w9qg-chfh-g3q9 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability |
Medium EPSS 0.23% |
< 9.4.8 | 9.4.8 |
| GHSA-f4vq-pj32-gr4q Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability |
Medium EPSS 0.24% |
< 9.4.8 | 9.4.8 |
| GHSA-45fj-fvmm-xcc5 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability |
Medium EPSS 0.24% |
< 9.4.8 | 9.4.8 |
| GHSA-6mxw-2vhf-42g5 Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) |
Medium EPSS 0.24% |
< 9.4.8 | 9.4.8 |
| GHSA-gj26-w59c-29mf Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection |
High EPSS 0.69% |
< 9.4.8 | 9.4.8 |
| GHSA-mm5f-5rqw-574f Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability |
Medium EPSS 0.23% |
< 9.4.8 | 9.4.8 |
| GHSA-r7vr-wg3f-8hr9 Concrete5 CMS contains an XPath injection vulnerability |
Critical | No fix yet | |
| GHSA-c5xf-rmv4-j85h Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page |
Medium EPSS 0.47% |
>= 9.0.0RC1, < 9.4.3 | 9.4.3 |
| GHSA-4pcg-pjp5-3mc6 Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page |
Medium EPSS 0.36% |
>= 9.0.0RC1, < 9.4.3 | 9.4.3 |
| GHSA-4pcg-pjp5-3mc6 Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page |
Medium EPSS 0.36% |
< 8.5.21 | 8.5.21 |
| GHSA-cmm4-p9v2-q453 Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) |
Medium EPSS 0.19% |
>= 9.0.0, < 9.4.0RC2 | 9.4.0RC2 |
| GHSA-cmm4-p9v2-q453 Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) |
Medium EPSS 0.19% |
< 8.5.20 | 8.5.20 |
| GHSA-xfqf-5rhg-5c73 ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field |
Low | <= 9.3.9 | No fix yet |
| GHSA-pvmx-mjmh-jfcx Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality |
Medium EPSS 0.33% |
< 9.4.0RC1 | 9.4.0RC1 |
| GHSA-q7qr-22qw-pqgx Cross site scripting in Concrete CMS |
Medium EPSS 0.53% |
>= 9.0.0, < 9.3.4 | 9.3.4 |
| GHSA-q7qr-22qw-pqgx Cross site scripting in Concrete CMS |
Medium EPSS 0.53% |
< 8.5.19 | 8.5.19 |
| GHSA-x8h2-255q-jg4x Cross site scripting in Concrete CMS |
Medium EPSS 0.49% |
>= 9.0.0, < 9.3.4 | 9.3.4 |
| GHSA-x8h2-255q-jg4x Cross site scripting in Concrete CMS |
Medium EPSS 0.49% |
< 8.5.19 | 8.5.19 |
| GHSA-998c-q8hh-h8gv Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block |
Medium EPSS 0.29% |
>= 9.0.0, < 9.3.3 | 9.3.3 |
| GHSA-xmxj-v2q8-8qx6 Concrete CMS Stored XSS in the "Next&Previous Nav" block |
Medium EPSS 0.44% |
< 8.5.19 | 8.5.19 |
| GHSA-xmxj-v2q8-8qx6 Concrete CMS Stored XSS in the "Next&Previous Nav" block |
Medium EPSS 0.44% |
>= 9.0.0, < 9.3.4 | 9.3.4 |
| GHSA-c47w-9mcf-w972 Concrete CMS vulnerable to Stored Cross-site Scripting |
Medium EPSS 0.40% |
>= 9.0.0RC1, < 9.3.3 | 9.3.3 |
| GHSA-q5wx-m95r-4cgc Concrete CMS Stored Cross-site Scripting vulnerability |
Medium EPSS 0.49% |
>= 9.0.0RC1, < 9.3.3 | 9.3.3 |
| GHSA-q5wx-m95r-4cgc Concrete CMS Stored Cross-site Scripting vulnerability |
Medium EPSS 0.49% |
< 8.5.18 | 8.5.18 |
| GHSA-w6j6-w6jx-vf2r Concrete CMS Stored XSS in getAttributeSetName |
Medium EPSS 0.44% |
>= 9.0.0, < 9.3.3 | 9.3.3 |
| GHSA-w6j6-w6jx-vf2r Concrete CMS Stored XSS in getAttributeSetName |
Medium EPSS 0.44% |
< 8.5.18 | 8.5.18 |
| GHSA-3cpf-jmmc-8jm3 Concrete CMS vulnerable to Stored Cross-site Scripting |
Medium EPSS 0.30% |
>= 9.0.0, <= 9.3.2 | No fix yet |
| GHSA-qgm9-rxmq-jxmq Concrete CMS Stored XSS in the Search Field |
Medium EPSS 0.36% |
>= 9.0.0RC1, < 9.2.8 | 9.2.8 |
| GHSA-qgm9-rxmq-jxmq Concrete CMS Stored XSS in the Search Field |
Medium EPSS 0.36% |
< 8.5.16 | 8.5.16 |
| GHSA-9qhc-pg6j-wf23 Concrete CMS Stored XSS in blocks of type file |
Medium EPSS 0.36% |
< 8.5.16 | 8.5.16 |
| GHSA-9qhc-pg6j-wf23 Concrete CMS Stored XSS in blocks of type file |
Medium EPSS 0.36% |
>= 9.0.0RC1, < 9.2.8 | 9.2.8 |
| GHSA-r7q4-cw9r-vhp4 Concrete CMS Stored XSS in the Custom Class page editing |
Medium EPSS 0.36% |
>= 9.0.0RC1, < 9.2.8 | 9.2.8 |
| GHSA-r7q4-cw9r-vhp4 Concrete CMS Stored XSS in the Custom Class page editing |
Medium EPSS 0.36% |
< 8.5.16 | 8.5.16 |
| GHSA-xwrh-qxmc-x8c8 Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter |
Medium EPSS 0.36% |
< 8.5.16 | 8.5.16 |
| GHSA-xwrh-qxmc-x8c8 Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter |
Medium EPSS 0.36% |
>= 9.0.0RC1, < 9.2.8 | 9.2.8 |
| GHSA-pj42-r64f-4xfq Concrete CMS Stored XSS on the calendar color settings screen |
Medium EPSS 0.36% |
>= 9.0.0RC1, < 9.2.8 | 9.2.8 |
| GHSA-pj42-r64f-4xfq Concrete CMS Stored XSS on the calendar color settings screen |
Medium EPSS 0.36% |
< 8.5.16 | 8.5.16 |
| GHSA-4m7h-34xm-4wjv Concrete CMS Stored Cross-site Scripting vulnerability |
Medium EPSS 0.31% |
< 9.2.7 | 9.2.7 |
| GHSA-9xxv-q6pp-96wq Concrete CMS Stored XSS |
Medium EPSS 0.55% |
>= 9.0.0, < 9.2.3 | 9.2.3 |
| GHSA-3rxx-8f33-7p6p Concrete CMS Cross Site Request Forgery (CSRF) vulnerability |
Medium EPSS 0.28% |
< 8.5.14 | 8.5.14 |
| GHSA-3rxx-8f33-7p6p Concrete CMS Cross Site Request Forgery (CSRF) vulnerability |
Medium EPSS 0.28% |
>= 9.0.0, < 9.2.3 | 9.2.3 |
| GHSA-45m2-8q7f-93wv Concrete CMS Cross Site Request Forgery (CSRF) vulnerability |
Medium EPSS 0.28% |
>= 9.0.0, < 9.2.3 | 9.2.3 |
| GHSA-x577-gcc9-9xjj Concrete CMS Stored XSS in Layout Preset Name |
Medium EPSS 0.49% |
< 8.5.14 | 8.5.14 |
| GHSA-x577-gcc9-9xjj Concrete CMS Stored XSS in Layout Preset Name |
Medium EPSS 0.49% |
>= 9.0.0, < 9.2.3 | 9.2.3 |
| GHSA-9v3w-cj7m-qh5g Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature |
Medium EPSS 0.45% |
>= 9.0.0RC1, < 9.2.5 | 9.2.5 |
| GHSA-mgp6-j658-vcw9 Concrete CMS vulnerable to stored XSS in file tags and description attributes |
Medium EPSS 0.40% |
>= 9.0.0RC1, < 9.2.5 | 9.2.5 |
| GHSA-q25h-jch8-gfrp Concrete CMS vulnerable to stored XSS via the Role Name field |
Medium EPSS 1.24% |
>= 9.0.0RC1, < 9.2.5 | 9.2.5 |
| GHSA-qp42-5pj7-4ccm Concrete CMS Cross Site Request Forgery (CSRF) |
Medium EPSS 0.23% |
< 9.2.3 | 9.2.3 |
| GHSA-36fr-3wg8-q5v8 Concrete CMS Cross-site Scripting vulnerability |
Medium EPSS 0.59% |
< 8.5.13 | 8.5.13 |
| GHSA-36fr-3wg8-q5v8 Concrete CMS Cross-site Scripting vulnerability |
Medium EPSS 0.59% |
>= 9.0.0, < 9.2.2 | 9.2.2 |
| GHSA-m87h-jxr6-f82w Concrete CMS allows unauthorized access because directories can be created with insecure permissions |
Critical EPSS 1.23% |
< 8.5.13 | 8.5.13 |
| GHSA-m87h-jxr6-f82w Concrete CMS allows unauthorized access because directories can be created with insecure permissions |
Critical EPSS 1.23% |
>= 9.0.0, < 9.2.2 | 9.2.2 |
| GHSA-4qv6-37xq-mgq2 Concrete CMS Cross-site Scripting vulnerability |
Medium EPSS 0.70% |
<= 9.2.1 | No fix yet |
| GHSA-wrp2-6v6j-hfmg ConcreteCMS vulnerable to Stored Cross-site Scripting |
Medium EPSS 0.71% |
<= 9.2.1 | No fix yet |
| GHSA-437p-jfm4-2387 ConcreteCMS Cross-site Scripting vulnerability |
Medium EPSS 0.60% |
<= 9.2.1 | No fix yet |
| GHSA-6xx7-r8x4-fpjp ConcreteCMS Cross-site Scripting vulnerability |
Medium EPSS 0.60% |
< 9.2.2 | 9.2.2 |
| GHSA-j6h5-ggv2-3rfv ConcreteCMS Cross-site Scripting vulnerability |
Medium EPSS 0.58% |
<= 9.2.1 | No fix yet |
| GHSA-6fm3-r6mf-j875 ConcreteCMS Cross-site Scripting vulnerability |
Medium EPSS 0.63% |
<= 9.2.1 | No fix yet |
| GHSA-p4jj-gwpg-9jwh ConcreteCMS Cross-site Scripting vulnerability |
Medium EPSS 0.58% |
< 9.2.2 | 9.2.2 |
| GHSA-8699-h45g-7hm8 Concrete CMS Cross-site Scripting vulnerability |
Medium EPSS 0.66% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-8699-h45g-7hm8 Concrete CMS Cross-site Scripting vulnerability |
Medium EPSS 0.66% |
< 8.5.10 | 8.5.10 |
| GHSA-ph6g-6v8w-8p6m Missing rate limit for password resets |
Medium EPSS 0.73% |
< 9.1.0 | 9.1.0 |
| GHSA-fgxj-g7x3-85cq Stored cross site scripting in RSS displayer |
Medium EPSS 0.39% |
< 9.1.0 | 9.1.0 |
| GHSA-474f-mcjv-pgrm Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names |
Medium EPSS 0.64% |
< 9.1.0 | 9.1.0 |
| GHSA-xfmj-r86m-j2hr Stored cross site scripting on API integration |
Medium EPSS 0.58% |
< 9.2.0 | 9.2.0 |
| GHSA-2ggc-552c-rmqr Stored cross site scripting on tags |
Medium EPSS 0.54% |
< 9.2.0 | 9.2.0 |
| GHSA-vcpr-hm2m-gjjj Reflected cross site scripting |
Medium EPSS 0.64% |
< 9.2.0 | 9.2.0 |
| GHSA-2j26-j953-2rph Stored cross site scripting on saved presets |
Medium EPSS 0.63% |
< 9.2.0 | 9.2.0 |
| GHSA-pj76-75cm-3552 Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section |
Low EPSS 0.76% |
< 9.2.0 | 9.2.0 |
| GHSA-f55r-8rcv-mqcf Concrete CMS missing secure cookie parameters |
Medium EPSS 0.59% |
< 9.2.0 | 9.2.0 |
| GHSA-9h33-5fxw-r2xv Stored cross site scripting via container name |
Medium EPSS 0.54% |
< 9.2.0 | 9.2.0 |
| GHSA-7vx2-5349-qj99 Withdrawn: ConcreteCMS vulnerable to Xpath injection attacks Withdrawn |
High | <= 9.1.3 | No fix yet |
| GHSA-xj33-8r43-r227 Concrete CMS vulnerable to cross-site scripting in the text input field |
Medium EPSS 0.66% |
< 8.5.10 | 8.5.10 |
| GHSA-xj33-8r43-r227 Concrete CMS vulnerable to cross-site scripting in the text input field |
Medium EPSS 0.66% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-jfmc-3975-fv5f Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library |
Medium EPSS 0.66% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-rg6w-c352-p8pg Concrete CMS vulnerable to Reflected Cross-site Scripting |
Medium EPSS 0.66% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-jfmc-3975-fv5f Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library |
Medium EPSS 0.66% |
< 8.5.10 | 8.5.10 |
| GHSA-rg6w-c352-p8pg Concrete CMS vulnerable to Reflected Cross-site Scripting |
Medium EPSS 0.66% |
< 8.5.10 | 8.5.10 |
| GHSA-vq39-q549-g786 Concrete CMS vulnerable to Cross-site Scripting via multilingual report |
Medium EPSS 0.66% |
< 8.5.10 | 8.5.10 |
| GHSA-9jc5-9wh5-mc36 Concrete CMS vulnerable to Cross-site Scripting |
Medium EPSS 0.61% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-3cxx-3f53-m92c Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS |
Medium EPSS 1.09% |
< 8.5.10 | 8.5.10 |
| GHSA-3cxx-3f53-m92c Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS |
Medium EPSS 1.09% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-8782-xgh5-r7mv Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons |
Medium EPSS 0.66% |
< 8.5.10 | 8.5.10 |
| GHSA-8782-xgh5-r7mv Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons |
Medium EPSS 0.66% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-9jc5-9wh5-mc36 Concrete CMS vulnerable to Cross-site Scripting |
Medium EPSS 0.61% |
< 8.5.10 | 8.5.10 |
| GHSA-m53v-5x5x-5m2p Concrete CMS vulnerable to Session Fixation |
Medium EPSS 0.64% |
< 8.5.10 | 8.5.10 |
| GHSA-m53v-5x5x-5m2p Concrete CMS vulnerable to Session Fixation |
Medium EPSS 0.64% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-q3hq-hm5h-qrx3 Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information |
Medium EPSS 0.48% |
< 8.5.10 | 8.5.10 |
| GHSA-q3hq-hm5h-qrx3 Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information |
Medium EPSS 0.48% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-vq39-q549-g786 Concrete CMS vulnerable to Cross-site Scripting via multilingual report |
Medium EPSS 0.66% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-q56r-mw39-944g Concrete CMS vulnerable to Improper Authentication |
Medium EPSS 0.66% |
< 8.5.10 | 8.5.10 |
| GHSA-q56r-mw39-944g Concrete CMS vulnerable to Improper Authentication |
Medium EPSS 0.66% |
>= 9.0.0, < 9.1.3 | 9.1.3 |
| GHSA-q48r-xg9h-78m8 Concrete CMS vulnerable to XML External Entity |
Medium EPSS 0.72% |
< 8.5.10 | 8.5.10 |
| GHSA-q48r-xg9h-78m8 Concrete CMS vulnerable to XML External Entity |
Medium EPSS 0.72% |
>= 9.0.0, < 9.1.2 | 9.1.2 |
| GHSA-w8fp-3gwq-gxpw Concrete CMS vulnerable to Cross-site Request Forgery |
High EPSS 0.49% |
>= 9.0.0RC1, < 9.1.3 | 9.1.3 |
| GHSA-w8fp-3gwq-gxpw Concrete CMS vulnerable to Cross-site Request Forgery |
High EPSS 0.49% |
< 8.5.10 | 8.5.10 |
| GHSA-7388-7vq2-m4f4 Concrete CMS Cross-site Scripting via Survey Blocks |
Medium EPSS 0.86% |
< 8.5.5 | 8.5.5 |
| GHSA-jxhp-rwqv-9fjj concrete5 vulnerable to Cross-site Scripting |
Low EPSS 0.93% |
< 5.7.4 | 5.7.4 |
| GHSA-x4x9-4c65-73w8 Concrete5 Vulnerable to Cross-Site Scripting (XSS) |
Medium EPSS 1.43% |
>= 5.5.1, < 5.6.1 | 5.6.1 |
| GHSA-2mvg-c6mg-3q63 Concrete CMS vulnerable to cross-site scripting (XSS) |
Medium EPSS 2.75% |
<= 8.1.0 | No fix yet |
| GHSA-gr23-g276-xc73 Cross Site Request Forgery in concrete5/concrete5 |
High EPSS 0.54% |
< 9.0.0 | 9.0.0 |
| GHSA-g4gm-pxh3-29fq Unrestricted Uploads in Concrete5 |
Medium EPSS 0.94% |
< 8.5.3 | 8.5.3 |
| GHSA-hf9p-9r39-r2h3 Unrestricted Uploads in Concrete5 |
High EPSS 2.94% |
< 8.5.3 | 8.5.3 |
| GHSA-284f-f2hw-j2gx Server-Side Request Forgery vulnerability in concrete5 |
High EPSS 1.23% |
< 8.5.5 | 8.5.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor