What’s Vulnerable › Products

Concrete CMS vulnerabilities

198 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 99 published in the last 12 months.

Check whether your Concrete CMS version is affected

Latest Concrete CMS vulnerabilities

• CVE-2026-85387 — Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access (CVSS 7.1)
• CVE-2026-18120 — Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data (CVSS 5.9)
• CVE-2026-87031 — Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation (CVSS 2.7)
• CVE-2026-87028 — Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields (CVSS 6.5)
• CVE-2026-85386 — Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block (CVSS 6.1)
• CVE-2026-85385 — Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field (CVSS 9.6)
• CVE-2026-81927 — Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode (CVSS 5.4)
• CVE-2026-81926 — Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog (CVSS 6.1)
• CVE-2026-18426 — Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit (CVSS 6.5)
• CVE-2026-81925 — Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format (CVSS 6.1)
• CVE-2026-18425 — IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages (CVSS 2.7)
• CVE-2026-18424 — Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports (CVSS 7.1)
• CVE-2026-18423 — Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres (CVSS 7.1)
• CVE-2026-18422 — Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation (CVSS 6.5)
• CVE-2026-81924 — Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation (CVSS 6.5)
• CVE-2026-81923 — Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor (CVSS 2.7)
• CVE-2026-81922 — "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages " (CVSS 2.7)
• CVE-2026-81921 — In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status (CVSS 5.4)
• CVE-2026-81920 — Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint (CVSS 4.3)
• CVE-2026-81919 — Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint (CVSS 4.3)
• CVE-2026-81897 — Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control (CVSS 5.4)
• CVE-2026-81896 — Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label (CVSS 5.4)
• CVE-2026-81895 — Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any` (CVSS 7.2)
• CVE-2026-81894 — Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field (CVSS 5.4)
• CVE-2026-18111 — Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification (CVSS 6.1)