要点
- CVE-2026-3244 是影响 concrete5/concrete5, concrete cms (concretecms) 的中危 (CVSS 4.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.23%，高于 13.6% 的漏洞。
- 修复：升级到 9.4.8 或更高版本。
Description
In Concrete CMS below version 9.4.8, A stored Cross-site Scripting (XSS) vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page names that executes when users search for and view those pages in search results.
The Concrete CMS security team thanks zolpak for reporting.
NVD description
In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page names that executes when users search for and view those pages in search results. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks zolpak for reporting
concrete5/concrete5 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free