En resumen
- CVE-2026-3244 es una vulnerabilidad MEDIO (CVSS 4.8) que afecta a concrete5/concrete5, concrete cms (concretecms).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.23%, mayor que el 13.6% de las vulnerabilidades.
- Solución: actualizar a 9.4.8 o posterior.
Description
In Concrete CMS below version 9.4.8, A stored Cross-site Scripting (XSS) vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page names that executes when users search for and view those pages in search results.
The Concrete CMS security team thanks zolpak for reporting.
NVD description
In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page names that executes when users search for and view those pages in search results. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks zolpak for reporting
Más vulnerabilidades de concrete5/concrete5
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free