Concrete CMS Cross-site Scripting via Survey Blocks

MEDIUM 5.4CVE-2021-28145 · GHSA-7388-7vq2-m4f4 · Published 18/03/2021 · updated 17/06/2026

In short

CVE-2021-28145 is a MEDIUM (CVSS 5.4) vulnerability affecting concrete5/concrete5, concrete cms (concretecms).
Chance of exploitation in the next 30 days (EPSS): 0.86%, higher than 58.5% of all vulnerabilities.
Fix: update to 8.5.5 or later.

Package	Affected versions	Patched versions
concrete5/concrete5 Packagist	`< 8.5.5`	`8.5.5`
concrete cms concretecms	`< 8.5.5`	`8.5.5`

Description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.

NVD description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

References

nvd.nist.gov/vuln/detail/CVE-2021-28145 · ADVISORY
documentation.concrete5.org/developers/introduction/version-history/855-release-notes · WEB
S1lkys/CVE-2021-40101 · WEB
concrete5.org/developers/security · WEB

More vulnerabilities in concrete5/concrete5

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

concrete5/concrete5

Packagist

< 8.5.5

8.5.5

concrete cms

concretecms

< 8.5.5

8.5.5

Description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.

NVD description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

More vulnerabilities in concrete5/concrete5

See all →