GHSA-jxhp-rwqv-9fjjLow

concrete5 vulnerable to Cross-site Scripting

Published
May 17, 2022
Last Modified
April 14, 2025

🔗 CVE IDs covered (1)

CVE-2015-3989 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.

🎯 Affected products1

  • composer/concrete5/concrete5:< 5.7.4

🔗 References (4)