S1lkys/CVE-2021-40101

PoC

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4

view exploit source poc_in_githubauthor S1lkyspublished 2021-10-18catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2021-40101US	high7.2	2.60% (85th)	Exploit	2021-11-30
An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.