GHSA-7388-7vq2-m4f4MediumCVSS 5.4

Concrete CMS Cross-site Scripting via Survey Blocks

Published
May 24, 2022
Last Modified
August 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-28145 →

📋 Description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.

🎯 Affected products1

  • composer/concrete5/concrete5:< 8.5.5

🔗 References (5)