CVE-2021-3111

概要

参考情報

• packetstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.html · Exploit
• packetstormsecurity.com/files/161997/Concrete5-8.5.4-Cross-Site-Scripting.html · Third Party Advisory
• documentation.concrete5.org/developers/introduction/version-history · Release Notes
• documentation.concrete5.org/developers/introduction/version-history/855-release-notes · Release Notes
• Quadron-Research-Lab/CVE · Exploit

concrete cms のその他の脆弱性

• CVE-2026-85387高 7.1Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account th…
• CVE-2026-18120中 5.9Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpress…
• CVE-2026-87031低 2.7n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Contr…
• CVE-2026-87028中 6.5Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board i…
• CVE-2026-85386中 6.1Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploa…