Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-8571US | medium4.8 | Exploit | ||
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause… | ||||
02
references
External citations — patches, advisories, analysis.
- https://documentation.concretecms.org/9-x/developers/introduction/version-history/943-release-notesWEB
- https://documentation.concretecms.org/developers/introduction/version-history/8521-release-notesWEB
- https://github.com/concretecms/concretecmsPACKAGE
- https://github.com/concretecms/concretecms/commit/4b39dcc17c309dc82eb8398e8cdb146942f62f92WEB
- https://github.com/concretecms/concretecms/commit/f7630b467d3a234d3d333ca117046a500e7ee2b6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-8571ADVISORY
- https://www.concretecms.org/downloadWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan