Concrete CMS · Report #4777
XSS in Theme Preview Tools File
Validstatus
2upvotes
28 Aug 2014disclosed
How it was found
https://github.com/concrete5/concrete5/blob/master/web/concrete/tools/themes/preview.php#L7
Note that one of those values near the end is not escaped.