Vulnerabilidades em Concrete CMS

139 resultados
Análise Vexday

Com 74 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o Concrete CMS apresenta taxa de exploração abaixo da média geral do catálogo, o que sugere menor pressão imediata de ataques oportunistas. No entanto, chama atenção o volume expressivo de 46 vulnerabilidades surgidas nos últimos 90 dias, indicando aceleração recente no ritmo de descoberta de falhas. O tipo de falha mais comum é CWE-352 (Cross-Site Request Forgery), padrão que tende a refletir deficiências estruturais na validação de requisições e merece atenção no processo de revisão de código. A CVE mais perigosa atualmente rastreada, CVE-2024-1247, possui EPSS de 0,0124, sinalizando probabilidade baixa de exploração em curto prazo, mas deve ser monitorada, especialmente diante do único CVE de severidade crítica presente no conjunto.

CVE-2026-81922LOW"In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "EPSS 0.3%CVE-2026-81915MEDIUMIn Concrete CMS below 9.5.3, Page Type update omits object-level authorizationEPSS 0.3%CVE-2026-81913MEDIUMConcrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.EPSS 0.3%CVE-2026-18426LOWConcrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot editEPSS 0.3%CVE-2024-8660MEDIUMStored XSS in the "Top Navigator Bar" blockEPSS 0.3%CVE-2026-7886LOWConcrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameterEPSS 0.3%CVE-2026-81925LOWConcrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date FormatEPSS 0.3%CVE-2026-81916MEDIUMIncorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized ObjectEPSS 0.3%CVE-2026-85387LOWConcrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API accessEPSS 0.3%CVE-2026-18116HIGHConcrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval NotificationsEPSS 0.3%CVE-2026-81900HIGHConcrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)EPSS 0.3%CVE-2026-81926LOWConcrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialogEPSS 0.3%CVE-2026-81918MEDIUMConcrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display blockEPSS 0.3%CVE-2026-18424LOWConcrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different portsEPSS 0.2%CVE-2026-3240MEDIUMConcrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy formEPSS 0.2%CVE-2026-81902HIGHConcrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block CleanupEPSS 0.2%CVE-2026-8347LOWConcrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialogEPSS 0.2%CVE-2026-84432MEDIUMConcrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controllerEPSS 0.2%CVE-2026-81921LOWIn Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account StatusEPSS 0.2%CVE-2026-3241MEDIUMConcrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.EPSS 0.2%