CVE-2022-50807

✕ Withdrawn — historical dataMEDIUMPre-NVD 9.8
9.8CVSS

Concrete5 CMS contains an XPath injection vulnerability

Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.

CVSS v3
9.8
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

January 14, 2026

Last Modified

January 14, 2026

Frequently asked(4)

What is CVE-2022-50807?
CVE-2022-50807 is a rejected CVE ID: its record was withdrawn on January 14, 2026 and no longer describes a vulnerability. Reason given: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.
When was the CVE record for CVE-2022-50807 published?
The CVE record for CVE-2022-50807 was published on January 14, 2026. EchelonGraph's copy of the record carries a last-modified date of January 14, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2022-50807?
CVE-2022-50807 has a CVSS base score of 9.8 (the CNA's own assessment, by github_m; NVD's own analysis pending).
How do I remediate CVE-2022-50807?
There is nothing to remediate under CVE-2022-50807: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.