Concrete CMS · disclosed reports
Cross-site Scripting
48 disclosed reports · $0 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Concrete CMS on HackerOne- reports
- 48
- paid a bounty
- 0
Every one of the 48 is a mark on the map. Named now: 1 to 26, most upvoted first.
- SVG file that HTML Included is able to upload via File Manager
- XSS in select attribute options
- Reflected XSS vulnerability in Database name field on installation screen
- Cross Site Scripting (XSS) Stored - Private messaging
- Unauthenticated reflected XSS in preview_as_user function
- Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ]
- Stored unauth XSS in calendar event via CSRF
- Stored XSS vulnerability in RSS Feeds Description field
- Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)
- Stored XSS in the file search filter
- Stored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains payload
- Stored XSS on Add Calendar
- Stored XSS on Add Event in Calendar
- Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]
- Stored XSS in Name field in User Groups/Group Details form
- XSS in private message
- XSS on [/concrete/concrete/elements/dashboard/sitemap.php]
- XSS IN member List (Because of City Textbox)
- Stored XSS on express entries
- Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text"
- Stored XSS in RSS Feeds Title (Concrete5 v8.1.0)
- /index.php/dashboard/sitemap/explore/ Cross-site scripting
- Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1
- Stored XSS in Feature tile
- Stored XSS in title of date navigation
- Stored XSS in Contact Form
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.