p PatchFirst

PatchFirst · Latest vulnerabilities

concrete5/concrete5 9.4.3: known vulnerabilities

Known vulnerabilities affecting concrete5/concrete5 9.4.3: 53. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 53

  1. CVE-2026-10721

    High · CVSS 8.4EPSS 0.15%Fix available

    Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components

    Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-7888

    High · CVSS 8.4EPSS 0.15%Fix available

    Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.

    Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. The Form block and File/Set sinks were addressed in 9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for independently reporting the original components, and sh4d0byss for reporting the Workflow component wasn't fixed in 9.5.2. The Concrete CMS security te

    concrete5/concrete5PHP
    • Update to 9.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-8353

    Low · CVSS 2.1EPSS 0.15%Fix available

    Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme

    Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-8347

    Low · CVSS 2.3EPSS 0.24%Fix available

    Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog

    Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.  This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-8340

    Low · CVSS 2.3EPSS 0.1%Fix available

    Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion

    Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd into publishing an attacker-chosen previously-uploaded version (downgrade to an older version of a file, or activation of a co-editor's unpublished version). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-8139

    Low · CVSS 2.0EPSS 0.15%Fix available

    Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName

    Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N.  Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-7890

    Low · CVSS 2.1EPSS 0.15%Fix available

    Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block

    In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses.  The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-8409

    Low · CVSS 2.3EPSS 0.14%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete.  The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-8410

    Low · CVSS 2.3EPSS 0.14%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete.  The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-8411

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-8412

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-8413

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-8414

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-8415

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-8416

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2026-8427

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2026-8432

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2026-8433

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-8434

    Low · CVSS 2.3EPSS 0.13%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-8435

    Low · CVSS 2.3EPSS 0.11%Fix available

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()

    Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

    concrete5/concrete5PHP
    • Update to 9.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →