| Package | Affected versions | Patched versions |
|---|---|---|
| concrete cms | < 8.5.5 | 8.5.5 |
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free