Concrete CMS · Report #50780

Stored XSS in Message to Display When No Pages Listed.

Validstatus

2upvotes

8 Jul 2015disclosed

How it was found

XSS payload can be executed and saved permanently in Message to Display When No Pages Listed. Poc code: "><img src=x onerror=alert(1)>

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original