Concrete CMS · Report #59662

Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1

Validstatus

3upvotes

26 Jun 2016disclosed

How it was found

Concrete5 is vulnerable to some stored Cross Site Scripting (XSS) attacks because certain user input is being used within the output it generates without validating or encoding it.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original