CVE-2026-3240

EPSS 0.01%

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Published: 3/4/2026Modified: 3/4/2026
Also known as:GHSA-45fj-fvmm-xcc5

Description

In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field.  The Concrete CMS security team thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 4.0—CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References (4)