Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id).Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id).Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete.Check if you run itEPSS 0.14%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete.Check if you run itEPSS 0.14%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys.Check if you run itEPSS 0.19%May 21, 2026
- Medium5.3Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.Check if you run itEPSS 0.18%May 21, 2026
- Medium6.0Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection.Check if you run itEPSS 0.14%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of…Check if you run itEPSS 0.19%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.Check if you run itEPSS 0.19%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.Check if you run itEPSS 0.20%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.Check if you run itEPSS 0.64%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate.Check if you run itEPSS 0.68%May 21, 2026
- Low2.0Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized.Check if you run itEPSS 0.15%May 21, 2026
- Low2.1In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-int…Check if you run itEPSS 0.15%May 21, 2026
- Low2.3For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status.Check if you run itEPSS 0.17%May 21, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass.Check if you run itEPSS 0.29%May 21, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller.Check if you run itEPSS 0.12%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter.Check if you run itEPSS 0.21%May 21, 2026
- Medium6.3In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading p…Check if you run itEPSS 0.22%May 21, 2026
Sort