Bug bounty program · HackerOne
Concrete CMS
Most upvoted reports87
- #768322ValidRemote Code Execution (Reverse Shell) - File ManagerConcrete CMS · Command and Code Injection · 2020–114votes
- #226659ValidPassword Reset link hijacking via Host Header PoisoningConcrete CMS · Access Control · 2017–73votes
- #876800ValidTime-base SQL Injection in Search UsersConcrete CMS · SQL Injection · 2020–60votes
- #921288ValidArbitrary File delete via PHAR deserializationConcrete CMS · Deserialization and Object Injection · 2021–28votes
- #437863ValidSVG file that HTML Included is able to upload via File ManagerConcrete CMS · Cross-site Scripting · 2019–26votes
- #265284Valid'cnvID' parameter vulnerable to Insecure Direct Object ReferencesConcrete CMS · Insecure Direct Object Reference · 2018–22votes
- #753567ValidXSS in select attribute optionsConcrete CMS · Cross-site Scripting · 2020–20votes
- #243865ValidSSRF thru File ReplaceConcrete CMS · Server-Side Request Forgery · 2018–19votes
- #289330ValidReflected XSS vulnerability in Database name field on installation screenConcrete CMS · Cross-site Scripting · 2018–18votes
- #1102067ValidAuthenticated path traversal to RCEConcrete CMS · File and Path Handling · 2021–18votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.