Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Multiple Cross Site Request Forgery Vulnerabilities in Concrete5 version 5.7.3.1#59660 | Valid | Cross-Site Request Forgery | – | 2016-06-26 | – | 3 |
| Stored XSS in Feature tile#50639 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 3 |
| Stored XSS in title of date navigation#50627 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 3 |
| Stored XSS in Contact Form#50564 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 3 |
| stored XSS in concrete5 5.7.2.1#38890 | Valid | Cross-site Scripting | – | 2016-04-26 | – | 3 |
| SQL injection in conc/index.php/ccm/system/search/users/submit#38778 | Valid | SQL Injection | – | 2016-04-26 | – | 3 |
| Stored XSS in concrete5 5.7.0.4.#30019 | Valid | Cross-site Scripting | – | 2015-03-11 | – | 3 |
| https://concrete5.org ::: HeartBleed Attack (CVE-2014-0160)#6475 | Valid | Information Disclosure | – | 2014-04-09 | – | 3 |
| Administrators can add other administrators#304642 | Informative | Access Control | None | 2020-05-11 | – | 2 |
| Content Spoofing possible in concrete5.org#168078 | Valid | Misconfiguration and Insecure Design | – | 2017-07-23 | – | 2 |
| No CSRF protection when creating new community points actions, and related stored XSS#65808 | Valid | Cross-site Scripting | – | 2015-08-26 | – | 2 |
| Multiple XSS Vulnerabilities in Concrete5 5.7.3.1#62294 | Valid | Cross-site Scripting | – | 2015-07-15 | – | 2 |
| Multiple Reflected Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1#59661 | Valid | Cross-site Scripting | – | 2015-06-06 | – | 2 |
| Stored XSS in Image Alt. Text#50782 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS in Message to Display When No Pages Listed.#50780 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS in Bio/Quote#50779 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS In Company URL#50662 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS in testimonial Company#50656 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS in Testimonial Position#50645 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS in Testimonial name#50644 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored Xss in Feature Paragraph#50642 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS in Title of the topic List#50626 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS on Search Title#50556 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS on Title of Page List in edit page list#50554 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS on Blog's page Tile#50552 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 2 |
| Stored XSS in adding fileset#42248 | Valid | Cross-site Scripting | – | 2016-04-26 | – | 2 |
| Weak random number generator used in concrete/authentication/concrete/controller.php#31171 | Valid | Cryptography | – | 2014-10-26 | – | 2 |
| Cross-Site Scripting in getMarketplacePurchaseFrame#6843 | Valid | Cross-site Scripting | – | 2014-08-18 | – | 2 |
| CONCRETE5 - path disclosure.#4931 | Valid | Information Disclosure | – | 2014-06-09 | – | 2 |
| dashboard/pages/types [Unknown column 'Array' in 'where clause'] disclosure.#4811 | Valid | Information Disclosure | – | 2014-06-09 | – | 2 |
| XSS in Theme Preview Tools File#4777 | Valid | Cross-site Scripting | – | 2014-08-28 | – | 2 |
| Host Header Injection allow HiJack Password Reset Link#301592 | Duplicate | No weakness recorded | Low | 2018-01-12 | – | 1 |
| Full Page Caching Stored XSS Vulnerability#148300 | Informative | Cross-site Scripting | – | 2017-04-11 | – | 1 |
| ProBlog 2.6.6 CSRF Exploit#133847 | Valid | Cross-Site Request Forgery | – | 2016-05-22 | – | 1 |
| No csrf protection on index.php/ccm/system/user/add_group, index.php/ccm/system/user/remove_group#64184 | Valid | Cross-Site Request Forgery | – | 2015-08-26 | – | 1 |
| SQL Injection Vulnerability in Concrete5 version 5.7.3.1#59664 | Valid | SQL Injection | – | 2015-06-11 | – | 1 |
| Self Xss on File Replace#50481 | Valid | Cross-site Scripting | – | 2015-07-08 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.