Security
فارسی
All products

concrete5/concrete5

Composer · Package
121 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Concrete CMS is vulnerable to unauthenticated page metadata disclosureCVE-2026-8240 · GHSA-VPGR-CWFX-PWFW concrete5/concrete5 Composer Medium Fix reported
Concrete CMS is vulnerable to IDORCVE-2026-8237 · GHSA-XPGC-7VC2-8725 concrete5/concrete5 Composer Medium Fix reported
Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialogCVE-2026-8347 · GHSA-JQVQ-GV67-3567 concrete5/concrete5 Composer Low Fix reported
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)CVE-2026-8416 · GHSA-QJ94-6RX6-27FR concrete5/concrete5 Composer Low Fix reported
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/designCVE-2026-8413 · GHSA-MPQ2-MV8P-9WM6 concrete5/concrete5 Composer Low Fix reported
Concrete CMS is vulnerable to IDORCVE-2026-8238 · GHSA-QV3X-MFFX-9GW8 concrete5/concrete5 Composer Medium Fix reported
Concrete CMS is vulnerable to Stored XSS via external-link page cvNameCVE-2026-8139 · GHSA-PCRH-GJ77-J4MW concrete5/concrete5 Composer Low Fix reported
Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessageCVE-2026-7886 · GHSA-P8P9-5953-H9JW concrete5/concrete5 Composer Low Fix reported
Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>`CVE-2026-8417 · GHSA-JR5G-QV3G-RXXX concrete5/concrete5 Composer High Fix reported
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()CVE-2026-8432 · GHSA-97JW-GR4M-C5V8 concrete5/concrete5 Composer Low Fix reported
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account StatusCVE-2026-7887 · GHSA-F54H-78C9-C24H concrete5/concrete5 Composer Low Fix reported
Concrete CMS is Vulnerable to Reflected XSS in Legacy PaginationCVE-2026-8245 · GHSA-F73J-PM2C-RXVR concrete5/concrete5 Composer Medium Fix reported
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validationCVE-2026-7890 · GHSA-GJWQ-9V8P-47W7 concrete5/concrete5 Composer Low Fix reported
Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail blockCVE-2026-7881 · GHSA-CHFM-CM6H-Q5X7 concrete5/concrete5 Composer Medium Fix reported
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()CVE-2026-8435 · GHSA-44Q4-354F-C826 concrete5/concrete5 Composer Low Fix reported
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/deleteCVE-2026-8409 · GHSA-56C9-XQ5G-XRF9 concrete5/concrete5 Composer Low Fix reported
Concrete CMS is vulnerable to IDOR in surveysCVE-2026-8337 · GHSA-8C7C-H7PX-267G concrete5/concrete5 Composer Medium Fix reported
Concrete CMS is vulnerable to IDORCVE-2026-8239 · GHSA-2XP7-RPVC-PJWC concrete5/concrete5 Composer Medium Fix reported
Concrete CMS is vulnerable to IDOR combined with a missing authentication gateCVE-2026-8236 · GHSA-58C8-VVQW-CM7M concrete5/concrete5 Composer Medium Fix reported
Concrete CMS is vulnerable to authorization bypass in the Calendar BlockCVE-2026-8205 · GHSA-46XH-7854-F568 concrete5/concrete5 Composer Medium Fix reported