Browse / Concrete CMS

Concrete CMS

See its reports on the map

What gets reported to Concrete CMS

• Cross-site Scripting50
• Code Execution6
• Misconfiguration5
• Information Disclosure5
• Server-Side Request Forgery4
• Cross-Site Request Forgery4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Remote Code Execution (Reverse Shell) - File ManagerCode Injection · medium
   114 votes
2. Password Reset link hijacking via Host Header Poisoning Privilege Escalation
   73 votes
3. Time-base SQL Injection in Search UsersSQL Injection · medium
   60 votes
4. Arbitrary File delete via PHAR deserializationDeserialization of Untrusted Data · high
   28 votes
5. SVG file that HTML Included is able to upload via File ManagerCross-site Scripting (XSS) - Stored · low
   26 votes
6. 'cnvID' parameter vulnerable to Insecure Direct Object ReferencesInsecure Direct Object Reference (IDOR) · critical
   22 votes
7. XSS in select attribute optionsCross-site Scripting (XSS) - Stored · low
   20 votes
8. SSRF thru File ReplaceServer-Side Request Forgery (SSRF)
   19 votes
9. Authenticated path traversal to RCEPath Traversal · high
   18 votes
10. Reflected XSS vulnerability in Database name field on installation screenCross-site Scripting (XSS) - Reflected · low
    18 votes
11. Remote Code Execution through Extension Bypass on Log FunctionalityCode Injection · high
    16 votes
12. SSRF bypassServer-Side Request Forgery (SSRF) · low
    15 votes
13. Cross Site Scripting (XSS) Stored - Private messagingCross-site Scripting (XSS) - Stored · low
    15 votes
14. Local File Inclusion path bypassViolation of Secure Design Principles
    13 votes
15. Unauthenticated reflected XSS in preview_as_user functionCross-site Scripting (XSS) - Reflected · medium
    12 votes
16. Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ]Cross-site Scripting (XSS) - Stored · medium
    12 votes
17. CSRF Full Account TakeoverCross-Site Request Forgery (CSRF)
    11 votes
18. Local File Inclusion Vulnerability in Concrete5 version 5.7.3.1Violation of Secure Design Principles
    11 votes
19. Bypass auth.email-domainsImproper Authentication - Generic
    11 votes
20. SSRF mitigation bypass using DNS Rebind attackServer-Side Request Forgery (SSRF) · low
    10 votes
21. A bypass of adding remote files in concrete5 FIlemanager leads to remote code executionCode Injection · medium
    10 votes
22. Stored unauth XSS in calendar event via CSRFCross-site Scripting (XSS) - Stored · medium
    10 votes
23. HttpOnly flag not set for cookie on concrete5.orgViolation of Secure Design Principles
    10 votes
24. Stored XSS vulnerability in RSS Feeds Description fieldCross-site Scripting (XSS) - Stored · low
    9 votes
25. Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)Cross-site Scripting (XSS) - Stored · medium
    9 votes
26. Stored XSS in the file search filterCross-site Scripting (XSS) - Stored · low
    8 votes
27. Stored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains payloadCross-site Scripting (XSS) - Stored · high
    8 votes
28. SSRF - pivoting in the private LANServer-Side Request Forgery (SSRF) · low
    7 votes
29. Stored XSS on Add CalendarCross-site Scripting (XSS) - Stored · low
    7 votes
30. Stored XSS on Add Event in CalendarCross-site Scripting (XSS) - Stored · low
    7 votes
31. Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]Cross-site Scripting (XSS) - Stored · low
    7 votes
32. Stored XSS in Name field in User Groups/Group Details formCross-site Scripting (XSS) - Stored · low
    7 votes
33. Stored XSS in Express Objects - Concrete5 v8.1.0Cross-site Scripting (XSS) - Stored
    7 votes
34. XSS in private messageCross-site Scripting (XSS) - Generic
    7 votes
35. Fetching the update json scheme from concrete5 over HTTP leads to remote code executionMan-in-the-Middle · high
    6 votes
36. Unauthenticated HTML Injection Stored - ContactUs formCross-site Scripting (XSS) - Generic · medium
    6 votes
37. broken authenticationImproper Authentication - Generic
    6 votes
38. FULL PATH DISCLOSUR Information Disclosure
    6 votes
39. XSS on [/concrete/concrete/elements/dashboard/sitemap.php]Cross-site Scripting (XSS) - Generic
    6 votes
40. XSS IN member List (Because of City Textbox)Cross-site Scripting (XSS) - Generic
    6 votes
41. Phar Deserialization Vulnerability via Logging SettingsDeserialization of Untrusted Data · medium
    5 votes
42. Stored XSS on express entriesCross-site Scripting (XSS) - Stored · low
    5 votes
43. Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text"Cross-site Scripting (XSS) - Stored · medium
    5 votes
44. open redirect to a remote website which can phish usersInformativeOpen Redirect · medium
    4 votes
45. Stored XSS in RSS Feeds Title (Concrete5 v8.1.0)Cross-site Scripting (XSS) - Stored
    4 votes
46. page_controls_menu_js can reveal collection version of pageInformation Disclosure
    4 votes
47. /index.php/dashboard/sitemap/explore/ Cross-site scriptingCross-site Scripting (XSS) - Generic
    4 votes
48. Unsafe usage of Host HTTP header in Concrete5 version 5.7.3.1InformativeViolation of Secure Design Principles
    3 votes
49. Sendmail Remote Code Execution Vulnerability in Concrete5 version 5.7.3.1Command Injection - Generic
    3 votes
50. Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1Cross-site Scripting (XSS) - Generic
    3 votes
51. Multiple Cross Site Request Forgery Vulnerabilities in Concrete5 version 5.7.3.1Cross-Site Request Forgery (CSRF)
    3 votes
52. Stored XSS in Feature tile Cross-site Scripting (XSS) - Generic
    3 votes
53. Stored XSS in title of date navigationCross-site Scripting (XSS) - Generic
    3 votes
54. Stored XSS in Contact FormCross-site Scripting (XSS) - Generic
    3 votes
55. stored XSS in concrete5 5.7.2.1Cross-site Scripting (XSS) - Generic
    3 votes
56. SQL injection in conc/index.php/ccm/system/search/users/submitSQL Injection
    3 votes
57. Stored XSS in concrete5 5.7.0.4.Cross-site Scripting (XSS) - Generic
    3 votes
58. https://concrete5.org ::: HeartBleed Attack (CVE-2014-0160)Information Disclosure
    3 votes
59. Administrators can add other administratorsInformativePrivilege Escalation
    2 votes
60. Content Spoofing possible in concrete5.orgViolation of Secure Design Principles
    2 votes
61. No CSRF protection when creating new community points actions, and related stored XSSCross-site Scripting (XSS) - Generic
    2 votes
62. Multiple XSS Vulnerabilities in Concrete5 5.7.3.1Cross-site Scripting (XSS) - Generic
    2 votes
63. Multiple Reflected Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1Cross-site Scripting (XSS) - Generic
    2 votes
64. Stored XSS in Image Alt. TextCross-site Scripting (XSS) - Generic
    2 votes
65. Stored XSS in Message to Display When No Pages Listed.Cross-site Scripting (XSS) - Generic
    2 votes
66. Stored XSS in Bio/QuoteCross-site Scripting (XSS) - Generic
    2 votes
67. Stored XSS In Company URLCross-site Scripting (XSS) - Generic
    2 votes
68. Stored XSS in testimonial CompanyCross-site Scripting (XSS) - Generic
    2 votes
69. Stored XSS in Testimonial PositionCross-site Scripting (XSS) - Generic
    2 votes
70. Stored XSS in Testimonial nameCross-site Scripting (XSS) - Generic
    2 votes
71. Stored Xss in Feature ParagraphCross-site Scripting (XSS) - Generic
    2 votes
72. Stored XSS in Title of the topic ListCross-site Scripting (XSS) - Generic
    2 votes
73. Stored XSS on Search TitleCross-site Scripting (XSS) - Generic
    2 votes
74. Stored XSS on Title of Page List in edit page listCross-site Scripting (XSS) - Generic
    2 votes
75. Stored XSS on Blog's page TileCross-site Scripting (XSS) - Generic
    2 votes
76. Stored XSS in adding filesetCross-site Scripting (XSS) - Generic
    2 votes
77. Weak random number generator used in concrete/authentication/concrete/controller.phpCryptographic Issues - Generic
    2 votes
78. Cross-Site Scripting in getMarketplacePurchaseFrameCross-site Scripting (XSS) - Generic
    2 votes
79. CONCRETE5 - path disclosure.Information Disclosure
    2 votes
80. dashboard/pages/types [Unknown column 'Array' in 'where clause'] disclosure.Information Disclosure
    2 votes
81. XSS in Theme Preview Tools FileCross-site Scripting (XSS) - Generic
    2 votes
82. Host Header Injection allow HiJack Password Reset LinkDuplicateCRLF Injection · low
    1 votes
83. Full Page Caching Stored XSS VulnerabilityInformativeCross-site Scripting (XSS) - Generic
    1 votes
84. ProBlog 2.6.6 CSRF ExploitCross-Site Request Forgery (CSRF)
    1 votes
85. No csrf protection on index.php/ccm/system/user/add_group, index.php/ccm/system/user/remove_groupCross-Site Request Forgery (CSRF)
    1 votes
86. SQL Injection Vulnerability in Concrete5 version 5.7.3.1SQL Injection
    1 votes
87. Self Xss on File ReplaceCross-site Scripting (XSS) - Generic
    1 votes