agentprime: concrete-cmsEvery new CVE for concrete-cms.https://agentprime.io/CVE-2026-18120: Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry datahttps://agentprime.io/advisories/CVE-2026-18120/https://agentprime.io/advisories/CVE-2026-18120/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 17:16:09 GMTCVECVE-2026-85387: Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API accesshttps://agentprime.io/advisories/CVE-2026-85387/https://agentprime.io/advisories/CVE-2026-85387/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 17:12:05 GMTCVECVE-2026-87031: Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creationhttps://agentprime.io/advisories/CVE-2026-87031/https://agentprime.io/advisories/CVE-2026-87031/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 16:40:04 GMTCVECVE-2026-87028: Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fieldshttps://agentprime.io/advisories/CVE-2026-87028/https://agentprime.io/advisories/CVE-2026-87028/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 16:36:56 GMTCVECVE-2026-85386: Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Blockhttps://agentprime.io/advisories/CVE-2026-85386/https://agentprime.io/advisories/CVE-2026-85386/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 16:33:53 GMTCVECVE-2026-85385: Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Fieldhttps://agentprime.io/advisories/CVE-2026-85385/https://agentprime.io/advisories/CVE-2026-85385/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 16:30:28 GMTCVECVE-2026-81927: Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization modehttps://agentprime.io/advisories/CVE-2026-81927/https://agentprime.io/advisories/CVE-2026-81927/CVSS 1.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 20:21:03 GMTCVECVE-2026-18426: Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edithttps://agentprime.io/advisories/CVE-2026-18426/https://agentprime.io/advisories/CVE-2026-18426/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 20:16:12 GMTCVECVE-2026-81926: Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialoghttps://agentprime.io/advisories/CVE-2026-81926/https://agentprime.io/advisories/CVE-2026-81926/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 20:14:18 GMTCVECVE-2026-81925: Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Formathttps://agentprime.io/advisories/CVE-2026-81925/https://agentprime.io/advisories/CVE-2026-81925/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 20:07:01 GMTCVECVE-2026-18425: IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pageshttps://agentprime.io/advisories/CVE-2026-18425/https://agentprime.io/advisories/CVE-2026-18425/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:52:04 GMTCVECVE-2026-18424: Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different portshttps://agentprime.io/advisories/CVE-2026-18424/https://agentprime.io/advisories/CVE-2026-18424/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:49:48 GMTCVECVE-2026-18423: Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on…https://agentprime.io/advisories/CVE-2026-18423/https://agentprime.io/advisories/CVE-2026-18423/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:30:13 GMTCVECVE-2026-18422: Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validationhttps://agentprime.io/advisories/CVE-2026-18422/https://agentprime.io/advisories/CVE-2026-18422/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:27:59 GMTCVECVE-2026-18421: Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not contr…https://agentprime.io/advisories/CVE-2026-18421/https://agentprime.io/advisories/CVE-2026-18421/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:10:51 GMTCVECVE-2026-68529: Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entrieshttps://agentprime.io/advisories/CVE-2026-68529/https://agentprime.io/advisories/CVE-2026-68529/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:08:45 GMTCVECVE-2026-68530: Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instanceshttps://agentprime.io/advisories/CVE-2026-68530/https://agentprime.io/advisories/CVE-2026-68530/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:06:50 GMTCVECVE-2026-68531: Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Searchhttps://agentprime.io/advisories/CVE-2026-68531/https://agentprime.io/advisories/CVE-2026-68531/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 19:03:38 GMTCVECVE-2026-81924: Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activationhttps://agentprime.io/advisories/CVE-2026-81924/https://agentprime.io/advisories/CVE-2026-81924/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:55:57 GMTCVECVE-2026-81923: Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editorhttps://agentprime.io/advisories/CVE-2026-81923/https://agentprime.io/advisories/CVE-2026-81923/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:53:26 GMTCVECVE-2026-81922: "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "https://agentprime.io/advisories/CVE-2026-81922/https://agentprime.io/advisories/CVE-2026-81922/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:51:33 GMTCVECVE-2026-81921: In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Statushttps://agentprime.io/advisories/CVE-2026-81921/https://agentprime.io/advisories/CVE-2026-81921/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:48:52 GMTCVECVE-2026-81920: Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpointhttps://agentprime.io/advisories/CVE-2026-81920/https://agentprime.io/advisories/CVE-2026-81920/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:46:30 GMTCVECVE-2026-68532: Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Actionhttps://agentprime.io/advisories/CVE-2026-68532/https://agentprime.io/advisories/CVE-2026-68532/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:44:33 GMTCVECVE-2026-68533: Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permissionhttps://agentprime.io/advisories/CVE-2026-68533/https://agentprime.io/advisories/CVE-2026-68533/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:27:03 GMTCVECVE-2026-68534: Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectorshttps://agentprime.io/advisories/CVE-2026-68534/https://agentprime.io/advisories/CVE-2026-68534/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:25:02 GMTCVECVE-2026-81919: Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpointhttps://agentprime.io/advisories/CVE-2026-81919/https://agentprime.io/advisories/CVE-2026-81919/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 18:22:54 GMTCVECVE-2026-81899: Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboardhttps://agentprime.io/advisories/CVE-2026-81899/https://agentprime.io/advisories/CVE-2026-81899/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 17:54:58 GMTCVECVE-2026-18115: In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.https://agentprime.io/advisories/CVE-2026-18115/https://agentprime.io/advisories/CVE-2026-18115/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 17:39:04 GMTCVECVE-2026-18113: Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Nameshttps://agentprime.io/advisories/CVE-2026-18113/https://agentprime.io/advisories/CVE-2026-18113/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 17:32:16 GMTCVECVE-2026-81898: Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association viewshttps://agentprime.io/advisories/CVE-2026-81898/https://agentprime.io/advisories/CVE-2026-81898/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 17:29:31 GMTCVECVE-2026-81897: Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_controlhttps://agentprime.io/advisories/CVE-2026-81897/https://agentprime.io/advisories/CVE-2026-81897/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:47:02 GMTCVECVE-2026-81896: Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Labelhttps://agentprime.io/advisories/CVE-2026-81896/https://agentprime.io/advisories/CVE-2026-81896/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:44:40 GMTCVECVE-2026-18111: Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verificationhttps://agentprime.io/advisories/CVE-2026-18111/https://agentprime.io/advisories/CVE-2026-18111/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:42:37 GMTCVECVE-2026-81895: Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`https://agentprime.io/advisories/CVE-2026-81895/https://agentprime.io/advisories/CVE-2026-81895/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:39:04 GMTCVECVE-2026-81894: Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption fieldhttps://agentprime.io/advisories/CVE-2026-81894/https://agentprime.io/advisories/CVE-2026-81894/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:35:37 GMTCVECVE-2026-18110: Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve th…https://agentprime.io/advisories/CVE-2026-18110/https://agentprime.io/advisories/CVE-2026-18110/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:33:36 GMTCVECVE-2026-81900: Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)https://agentprime.io/advisories/CVE-2026-81900/https://agentprime.io/advisories/CVE-2026-81900/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 22:07:58 GMTCVECVE-2026-18116: Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notificationshttps://agentprime.io/advisories/CVE-2026-18116/https://agentprime.io/advisories/CVE-2026-18116/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 22:05:49 GMTCVECVE-2026-18117: Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Namehttps://agentprime.io/advisories/CVE-2026-18117/https://agentprime.io/advisories/CVE-2026-18117/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 21:27:57 GMTCVECVE-2026-81901: Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpointhttps://agentprime.io/advisories/CVE-2026-81901/https://agentprime.io/advisories/CVE-2026-81901/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 20:38:54 GMTCVECVE-2026-81902: Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanuphttps://agentprime.io/advisories/CVE-2026-81902/https://agentprime.io/advisories/CVE-2026-81902/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 20:34:23 GMTCVECVE-2026-81903: Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container iconhttps://agentprime.io/advisories/CVE-2026-81903/https://agentprime.io/advisories/CVE-2026-81903/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 20:14:25 GMTCVECVE-2026-18119: Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style valueshttps://agentprime.io/advisories/CVE-2026-18119/https://agentprime.io/advisories/CVE-2026-18119/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 19:54:11 GMTCVECVE-2026-81907: Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity recordshttps://agentprime.io/advisories/CVE-2026-81907/https://agentprime.io/advisories/CVE-2026-81907/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 20:21:48 GMTCVECVE-2026-81918: Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display blockhttps://agentprime.io/advisories/CVE-2026-81918/https://agentprime.io/advisories/CVE-2026-81918/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 20:19:58 GMTCVECVE-2026-81917: Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tagshttps://agentprime.io/advisories/CVE-2026-81917/https://agentprime.io/advisories/CVE-2026-81917/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 20:16:06 GMTCVECVE-2026-68535: Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissionshttps://agentprime.io/advisories/CVE-2026-68535/https://agentprime.io/advisories/CVE-2026-68535/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 20:12:17 GMTCVECVE-2026-81916: Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Objecthttps://agentprime.io/advisories/CVE-2026-81916/https://agentprime.io/advisories/CVE-2026-81916/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 20:09:05 GMTCVECVE-2026-81915: In Concrete CMS below 9.5.3, Page Type update omits object-level authorizationhttps://agentprime.io/advisories/CVE-2026-81915/https://agentprime.io/advisories/CVE-2026-81915/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 19:39:03 GMTCVE