Skip to content
OpenAdvisories

Vendor

concretecms-community-store

2 known vulnerabilities.

Products

community_store 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-95653

    Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

    Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate va…

    concretecms-community-store community_store
  • High 8.1
    CVE-2026-93659 Public exploit

    Concrete CMS Community Store before 2.7.8 Stored XSS

    Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manag…

    concretecms-community-store community_store