Concrete CMS · Report #59661

Multiple Reflected Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1

Validstatus

2upvotes

6 Jun 2015disclosed

How it was found

Concrete5 is vulnerable to some reflected Cross Site Scripting (XSS) attacks because certain user input is being used within the output it generates without validating or encoding it.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original