CVE-2025-2967

✕ Withdrawn — historical dataMEDIUMPre-NVD 3.5
3.5CVSS

ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field

A vulnerability was found in ConcreteCMS up to 9.3.9. It has been classified as problematic. This affects the function Save of the component HTML Block Handler. The manipulation of the argument content leads to HTML injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3
3.5
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

March 31, 2025

Last Modified

March 31, 2025

Frequently asked(4)

What is CVE-2025-2967?
CVE-2025-2967 is a rejected CVE ID: its record was withdrawn on April 4, 2025 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
When was the CVE record for CVE-2025-2967 published?
The CVE record for CVE-2025-2967 was published on March 31, 2025. EchelonGraph's copy of the record carries a last-modified date of March 31, 2025; the record at its source may have been updated since.
What is the CVSS score of CVE-2025-2967?
CVE-2025-2967 has a CVSS base score of 3.5 (the CNA's own assessment, by github_m; NVD's own analysis pending).
How do I remediate CVE-2025-2967?
There is nothing to remediate under CVE-2025-2967: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.