Concretecms
Concretecms Concrete CMS: vulnerabilidades y CVE
Concretecms Concrete CMS tiene 221 vulnerabilidades publicadas, 118 de ellas en los últimos 12 meses. 7 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE221
Últimos 12 meses118
Críticas7
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-85387 | Baja (2) | 0.26% | — | 16 sept 2026 | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator… |
| CVE-2026-18120 | Media (6.3) | 0.27% | — | 16 sept 2026 | Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow.… |
| CVE-2026-87031 | Baja (2.1) | 0.34% | — | 16 sept 2026 | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perform a permission check before creating an account.… |
| CVE-2026-87028 | Media (5.3) | 0.38% | — | 16 sept 2026 | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce… |
| CVE-2026-85386 | Alta (7.3) | 0.24% | — | 16 sept 2026 | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible… |
| CVE-2026-85385 | Alta (7.7) | 0.50% | — | 16 sept 2026 | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName() returns any… |
| CVE-2026-68534 | Baja (2.3) | 0.56% | — | 15 sept 2026 | Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public… |
| CVE-2026-68533 | Baja (2.3) | 0.39% | — | 15 sept 2026 | Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored.… |
| CVE-2026-68531 | Baja (2.1) | 0.46% | — | 15 sept 2026 | Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher… |
| CVE-2026-68530 | Baja (2.1) | 0.47% | — | 15 sept 2026 | Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly… |
| CVE-2026-68529 | Baja (2.1) | 0.44% | — | 15 sept 2026 | Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express… |
| CVE-2026-18421 | Baja (2.1) | 0.27% | — | 15 sept 2026 | Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and delete_data_source), which resolve a… |
| CVE-2026-81927 | Baja (1.8) | 0.24% | — | 15 sept 2026 | Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode… |
| CVE-2026-81926 | Baja (2) | 0.26% | — | 15 sept 2026 | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in… |
| CVE-2026-18426 | Baja (2) | 0.21% | — | 15 sept 2026 | Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to… |
| CVE-2026-81899 | Alta (7.3) | 0.48% | — | 15 sept 2026 | Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder… |
| CVE-2026-81925 | Baja (2.1) | 0.27% | — | 15 sept 2026 | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in… |
| CVE-2026-18115 | Alta (7.4) | 0.26% | — | 15 sept 2026 | Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). A user with… |
| CVE-2026-18425 | Baja (2.1) | 0.12% | — | 15 sept 2026 | Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit… |
| CVE-2026-18424 | Baja (2.1) | 0.24% | — | 15 sept 2026 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first… |
| CVE-2026-18423 | Baja (2.1) | 0.25% | — | 15 sept 2026 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single… |
| CVE-2026-18422 | Baja (2.1) | 0.44% | — | 15 sept 2026 | Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). As a result, an… |
| CVE-2026-81924 | Baja (2.1) | 0.21% | — | 15 sept 2026 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activate_files() action created PageTemplate records… |
| CVE-2026-81923 | Baja (2.1) | 0.30% | — | 15 sept 2026 | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called… |
| CVE-2026-81922 | Baja (2.1) | 0.30% | — | 15 sept 2026 | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and send_to_bottom reorder tasks ran after… |
| CVE-2026-81921 | Baja (2.3) | 0.24% | — | 15 sept 2026 | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated… |
| CVE-2026-81920 | Baja (2.3) | 0.18% | — | 15 sept 2026 | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list… |
| CVE-2026-81919 | Baja (2.3) | 0.15% | — | 15 sept 2026 | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit… |
| CVE-2026-68532 | Baja (2.3) | 0.30% | — | 15 sept 2026 | Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with… |
| CVE-2026-81898 | Alta (7.5) | 0.44% | — | 15 sept 2026 | In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.