Skip to content
OpenAdvisories

Vendor

Concrete CMS

139 known vulnerabilities.

Products

Concrete CMS 139
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-8337 Public exploit

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by su…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 6.3
    CVE-2026-8237 Public exploit Scanner template

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint

    Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from re…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 6.3
    CVE-2026-8239 Public exploit

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'

    Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with …

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 6.9
    CVE-2026-6826 Public exploit Scanner template

    Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller

    Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.  Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of eve…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 4.8
    CVE-2025-8571 Public exploit

    Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

    Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to m…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist