Medium · 5.4 CVE-2023-28471 EUVD-2023-1249GHSA-9h33-5fxw-r2xv

Stored cross site scripting via container name

Published Apr 28, 2023 · Updated Jan 31, 2025 · Assigned by mitre

Description

Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.

Ecosystem	Package	Affected	Fixed	Record
Packagist	concrete5/concrete5	< 9.2.0	9.2.0	GHSA-9h33-5fxw-r2xv