Concrete CMS vulnerable to cross-site scripting (XSS)

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2017-7725 · ADVISORY
• hackerone.com/reports/148300 · WEB
• packetstormsecurity.com/files/142145/concrete5-8.1.0-Host-Header-Injection.html · WEB
• web.archive.org/web/20210124030008/https://www.securityfocus.com/bid/97649 · WEB
• exploit-db.com/exploits/41885 · WEB
• hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt · WEB
• securityfocus.com/bid/97649 · Third Party Advisory
• exploit-db.com/exploits/41885 · Exploit

Lỗ hổng khác của concrete5/concrete5

• CVE-2026-10721CAO 8.4Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. …
• CVE-2026-7888CAO 8.4Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components …
• CVE-2026-8353TRUNG BÌNH 4.8Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScr…
• CVE-2026-8347TRUNG BÌNH 4.3Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.  This can cause Cr…
• CVE-2026-8340TRUNG BÌNH 4.3Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd int…