Headline
GHSA-vcpr-hm2m-gjjj: Reflected cross site scripting
Concrete CMS (previously concrete5) before 9.2 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
Reflected cross site scripting
Low severity GitHub Reviewed Published Apr 28, 2023 to the GitHub Advisory Database • Updated May 1, 2023
Related news
CVE-2023-48649: 2023-11-09 Security Blog about updated CVEs and new releases
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.