CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 18/03/2021 |
| CVE-2021-3111 | 보통4.8 | The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI. | 08/01/2021 |
| CVE-2020-24986 | 높음7.2 | Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands. | 04/09/2020 |
| CVE-2020-11476 | 높음7.2 | Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file. | 28/07/2020 |
| CVE-2020-14961 | 보통5.3 | Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value. | 22/06/2020 |
| CVE-2011-3183 | 보통6.1 | A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier. | 14/01/2020 |
| CVE-2018-19146 | 보통4.8 | Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element. | 17/06/2019 |
| CVE-2018-13790 | 높음7.2 | A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page. | 09/07/2018 |
| CVE-2017-18195 | 보통5.3 | An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers. | 26/02/2018 |
| CVE-2015-4724 | 높음8.8 | SQL injection vulnerability in Concrete5 5.7.3.1. | 07/09/2017 |
| CVE-2015-4721 | 보통6.1 | Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1. | 07/09/2017 |
| CVE-2017-8082 | 보통6.5 | concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making | 24/04/2017 |
| CVE-2017-7725 | 보통6.1 | concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrar | 13/04/2017 |
| CVE-2014-9526 | 보통4.3 | Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/groups/bulkupdate.php or (2) instance_id parameter in tools/dashboard/sitemap_drag_request.php. | 05/01/2015 |
| CVE-2014-5108 | 보통4.3 | Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file. | 28/07/2014 |
| CVE-2014-5107 | 보통5.0 | concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permis | 28/07/2014 |