Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

**Stored cross site scripting in RSS displayer**

Low severity GitHub Reviewed Published Apr 28, 2023 to the GitHub Advisory Database • Updated May 1, 2023

GHSA-fgxj-g7x3-85cq: Stored cross site scripting in RSS displayer

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

**Reflected cross site scripting**

Low severity GitHub Reviewed Published Apr 28, 2023 to the GitHub Advisory Database • Updated May 1, 2023

GHSA-vcpr-hm2m-gjjj: Reflected cross site scripting

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS via a container name.

**Stored cross site scripting via container name**

Moderate severity GitHub Reviewed Published Apr 28, 2023 to the GitHub Advisory Database • Updated May 1, 2023

GHSA-9h33-5fxw-r2xv: Stored cross site scripting via container name

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS on Saved Presets on search.

**Stored cross site scripting on saved presets**

Moderate severity GitHub Reviewed Published Apr 28, 2023 to the GitHub Advisory Database • Updated May 1, 2023

GHSA-2j26-j953-2rph: Stored cross site scripting on saved presets

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS on Tags on uploaded files.

**Stored cross site scripting on tags**

Moderate severity GitHub Reviewed Published Apr 28, 2023 to the GitHub Advisory Database • Updated May 5, 2023

GHSA-2ggc-552c-rmqr: Stored cross site scripting on tags

Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

CVE-2023-28821: Releases · concretecms/concretecms

**Trusted by the best**

In a crowded marketspace, Concrete stands out as a solution that pairs robust functionality with ease of use and a low cost of deployment.

Ben Dickie Research Director - Enterprise Applications at Info-Tech Research Group

Listen to our Customers

**Read More Reviews**

**In-Context Editing**

*   Effortlessly edit your website like you're writing a document.
*   New content editors can be trained in minutes flat.
*   Better tools make better work. Enjoy the process.

  
Schedule Demo

Because the system is a pleasure to use for our authors, our content is fresher.

Stefan Glut Online Communications Officer, BASF Corporation

**Powerful Permissions**

*   User roles and groups provide a powerful tool for managing access control and permissions, ensuring that your website is secure and accessible to authorized users only.
*   Granular permissions that let you control every aspect of your website with ease.
*   Transform your content editing process with efficient and secure approval workflows.
*   Streamline collaboration on your website with Concrete CMS.
*   Track changes made to your website with a complete record of who made each change.
*   Review, compare, and roll back to previous versions. 

  
Schedule Demo

Amazing and really well thought out CMS. Great for editors and very good for developers to build off.

Tim Macknelly Creative Director, TM Designs

**Secure & Supported**

*   You get a fully ISO:27001 solution out of the box.
*   All our hosting is SOC 2 Security and Availability Certified and HIPAA Compliant.
*   Used by the U.S. Army. Choose to host your site with us to meet any unique compliance and security needs your organization may have. 

  
Schedule Demo

Concrete CMS powers an Army web presence that hundreds of editors use with very limited training. It also meets our complex security and compliance requirements.

Melanie Reagin U.S. Army, IMCOM

The Basketball Hall of Fame Scores Big With A Concrete CMS-Powered Website

Apr 27, 2023

Explore the Basketball Hall of Fame's website, built with Concrete CMS for a slam dunk user experience. Learn about the history and legacy of basketball while staying up-to-date with the latest events and guest appearances by basketball legends.

Ways to Contribute to FOSS Beyond Development

Apr 25, 2023

Discover how non-developers can make valuable contributions to Free and Open Source Software (FOSS) through documentation, translation, design, support, marketing, and testing. Learn how to get involved and make a difference in the FOSS community.

The Power of Concrete CMS: Goodwill of Western and Northern Connecticut and Walk Japan's Success Stories

Apr 20, 2023

Find out how Concrete CMS helped Goodwill of Western and Northern Connecticut and Walk Japan make their websites better and attract more customers. Thanks to Concrete CMS, they were able to make their sites easy to use and reliable, resulting in happier customers and more money in their pockets.

CVE-2023-28471: Home

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2023-30123: There is a Stored-XSS vulnerability in WUZHI CMS 4.1.0 · Issue #205 · wuzhicms/wuzhicms

EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).

CVE-2023-30125: There is a xss causes XSS to steal sensitive information of logged-in users · Issue #40 · weng-xianhu/eyoucms

A vulnerability, which was classified as problematic, has been found in SourceCodester Online DJ Management System 1.0. Affected by this issue is some unknown functionality of the file classes/Master.php?f=save_event. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227648.

Tag

#xss