Self Xss on File Replace #50481 Valid Cross-site Scripting – 2015-07-08 – 1 Full Page Caching Stored XSS Vulnerability #148300 Informative Cross-site Scripting – 2017-04-11 – 1 XSS in Theme Preview Tools File #4777 Valid Cross-site Scripting – 2014-08-28 – 2 Cross-Site Scripting in getMarketplacePurchaseFrame #6843 Valid Cross-site Scripting – 2014-08-18 – 2 Stored XSS in adding fileset #42248 Valid Cross-site Scripting – 2016-04-26 – 2 Stored XSS on Blog's page Tile #50552 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS on Title of Page List in edit page list #50554 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS on Search Title #50556 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Title of the topic List #50626 Valid Cross-site Scripting – 2015-07-08 – 2 Stored Xss in Feature Paragraph #50642 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Testimonial name #50644 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Testimonial Position #50645 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in testimonial Company #50656 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS In Company URL #50662 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Bio/Quote #50779 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Message to Display When No Pages Listed. #50780 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Image Alt. Text #50782 Valid Cross-site Scripting – 2015-07-08 – 2 Multiple Reflected Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1 #59661 Valid Cross-site Scripting – 2015-06-06 – 2 Multiple XSS Vulnerabilities in Concrete5 5.7.3.1 #62294 Valid Cross-site Scripting – 2015-07-15 – 2 No CSRF protection when creating new community points actions, and related stored XSS #65808 Valid Cross-site Scripting – 2015-08-26 – 2 Stored XSS in concrete5 5.7.0.4. #30019 Valid Cross-site Scripting – 2015-03-11 – 3 stored XSS in concrete5 5.7.2.1 #38890 Valid Cross-site Scripting – 2016-04-26 – 3 Stored XSS in Contact Form #50564 Valid Cross-site Scripting – 2015-07-08 – 3 Stored XSS in title of date navigation #50627 Valid Cross-site Scripting – 2015-07-08 – 3 Stored XSS in Feature tile #50639 Valid Cross-site Scripting – 2015-07-08 – 3 Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1 #59662 Valid Cross-site Scripting – 2016-06-26 – 3 /index.php/dashboard/sitemap/explore/ Cross-site scripting #4808 Valid Cross-site Scripting – 2014-06-09 – 4 Stored XSS in RSS Feeds Title (Concrete5 v8.1.0) #221380 Valid Cross-site Scripting – 2017-05-17 – 4 Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text" #616770 Valid Cross-site Scripting Medium 2021-10-04 – 5 Stored XSS on express entries #873474 Valid Cross-site Scripting Low 2020-07-03 – 5 XSS IN member List (Because of City Textbox) #4839 Valid Cross-site Scripting – 2014-04-16 – 6 XSS on [/concrete/concrete/elements/dashboard/sitemap.php] #6853 Valid Cross-site Scripting – 2014-08-28 – 6 XSS in private message #4826 Valid Cross-site Scripting – 2014-05-14 – 7 Stored XSS in Name field in User Groups/Group Details form #247521 Valid Cross-site Scripting Low 2017-08-17 – 7 Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap] #251358 Valid Cross-site Scripting Low 2017-11-02 – 7 Stored XSS on Add Event in Calendar #300532 Valid Cross-site Scripting Low 2018-09-01 – 7 Stored XSS on Add Calendar #300571 Valid Cross-site Scripting Low 2018-09-01 – 7 Stored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains payload #247517 Valid Cross-site Scripting High 2017-08-17 – 8 Stored XSS in the file search filter #873584 Valid Cross-site Scripting Low 2020-07-03 – 8 Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0) #230029 Valid Cross-site Scripting Medium 2017-07-27 – 9 Stored XSS vulnerability in RSS Feeds Description field #248133 Valid Cross-site Scripting Low 2017-08-18 – 9 Stored unauth XSS in calendar event via CSRF #1102018 Valid Cross-site Scripting Medium 2021-10-15 – 10 Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ] #230278 Valid Cross-site Scripting Medium 2017-07-14 – 12 Unauthenticated reflected XSS in preview_as_user function #643442 Valid Cross-site Scripting Medium 2019-12-06 – 12 Cross Site Scripting (XSS) Stored - Private messaging Analysed #768313 Valid Cross-site Scripting Low 2020-09-25 – 15 Reflected XSS vulnerability in Database name field on installation screen Analysed #289330 Valid Cross-site Scripting Low 2018-01-20 – 18 XSS in select attribute options Analysed #753567 Valid Cross-site Scripting Low 2020-04-29 – 20 SVG file that HTML Included is able to upload via File Manager Analysed #437863 Valid Cross-site Scripting Low 2019-04-20 – 26