Remote Code Execution (Reverse Shell) - File Manager Analysed #768322 Valid Command and Code Injection Medium 2020-07-21 – 114 Password Reset link hijacking via Host Header Poisoning Analysed #226659 Valid Access Control None 2017-06-06 – 73 Time-base SQL Injection in Search Users Analysed #876800 Valid SQL Injection Medium 2020-08-05 – 60 Arbitrary File delete via PHAR deserialization #921288 Valid Deserialization and Object Injection High 2021-10-20 – 28 SVG file that HTML Included is able to upload via File Manager #437863 Valid Cross-site Scripting Low 2019-04-20 – 26 'cnvID' parameter vulnerable to Insecure Direct Object References #265284 Valid Insecure Direct Object Reference Critical 2018-04-15 – 22 XSS in select attribute options #753567 Valid Cross-site Scripting Low 2020-04-29 – 20 SSRF thru File Replace #243865 Valid Server-Side Request Forgery – 2018-01-06 – 19 Authenticated path traversal to RCE #1102067 Valid File and Path Handling High 2021-10-15 – 18 Reflected XSS vulnerability in Database name field on installation screen #289330 Valid Cross-site Scripting Low 2018-01-20 – 18 Remote Code Execution through Extension Bypass on Log Functionality #841947 Valid Command and Code Injection High 2020-07-03 – 16 SSRF bypass #863221 Valid Server-Side Request Forgery Low 2021-10-04 – 15 Cross Site Scripting (XSS) Stored - Private messaging #768313 Valid Cross-site Scripting Low 2020-09-25 – 15 Local File Inclusion path bypass #147570 Valid Misconfiguration and Insecure Design – 2016-08-19 – 13 Unauthenticated reflected XSS in preview_as_user function #643442 Valid Cross-site Scripting Medium 2019-12-06 – 12 Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ] #230278 Valid Cross-site Scripting Medium 2017-07-14 – 12 CSRF Full Account Takeover #152052 Valid Cross-Site Request Forgery – 2016-08-12 – 11 Local File Inclusion Vulnerability in Concrete5 version 5.7.3.1 #59665 Valid Misconfiguration and Insecure Design – 2016-06-26 – 11 Bypass auth.email-domains #4795 Valid Authentication – 2014-04-30 – 11 SSRF mitigation bypass using DNS Rebind attack #1369312 Valid Server-Side Request Forgery Low 2022-11-25 – 10 A bypass of adding remote files in concrete5 FIlemanager leads to remote code execution #1350444 Valid No weakness recorded Medium 2021-11-11 – 10 Stored unauth XSS in calendar event via CSRF #1102018 Valid Cross-site Scripting Medium 2021-10-15 – 10 HttpOnly flag not set for cookie on concrete5.org #4792 Valid Misconfiguration and Insecure Design – 2014-04-16 – 10 Stored XSS vulnerability in RSS Feeds Description field #248133 Valid Cross-site Scripting Low 2017-08-18 – 9 Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0) #230029 Valid Cross-site Scripting Medium 2017-07-27 – 9 Stored XSS in the file search filter #873584 Valid Cross-site Scripting Low 2020-07-03 – 8 Stored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains payload #247517 Valid Cross-site Scripting High 2017-08-17 – 8 SSRF - pivoting in the private LAN #1364797 Valid Server-Side Request Forgery Low 2022-11-25 – 7 Stored XSS on Add Calendar #300571 Valid Cross-site Scripting Low 2018-09-01 – 7 Stored XSS on Add Event in Calendar #300532 Valid Cross-site Scripting Low 2018-09-01 – 7 Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap] #251358 Valid Cross-site Scripting Low 2017-11-02 – 7 Stored XSS in Name field in User Groups/Group Details form #247521 Valid Cross-site Scripting Low 2017-08-17 – 7 Stored XSS in Express Objects - Concrete5 v8.1.0 #221325 Valid No weakness recorded – 2017-05-17 – 7 XSS in private message #4826 Valid Cross-site Scripting – 2014-05-14 – 7 Fetching the update json scheme from concrete5 over HTTP leads to remote code execution #982130 Valid Cryptography High 2021-09-22 – 6 Unauthenticated HTML Injection Stored - ContactUs form #768327 Valid No weakness recorded Medium 2020-09-25 – 6 broken authentication #23921 Valid Authentication – 2014-09-21 – 6 FULL PATH DISCLOSUR #7736 Valid Information Disclosure – 2014-04-17 – 6 XSS on [/concrete/concrete/elements/dashboard/sitemap.php] #6853 Valid Cross-site Scripting – 2014-08-28 – 6 XSS IN member List (Because of City Textbox) #4839 Valid Cross-site Scripting – 2014-04-16 – 6 Phar Deserialization Vulnerability via Logging Settings #1063039 Valid Deserialization and Object Injection Medium 2021-09-24 – 5 Stored XSS on express entries #873474 Valid Cross-site Scripting Low 2020-07-03 – 5 Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text" #616770 Valid Cross-site Scripting Medium 2021-10-04 – 5 Stored XSS in RSS Feeds Title (Concrete5 v8.1.0) #221380 Valid Cross-site Scripting – 2017-05-17 – 4 page_controls_menu_js can reveal collection version of page #4938 Valid Information Disclosure – 2014-03-31 – 4 /index.php/dashboard/sitemap/explore/ Cross-site scripting #4808 Valid Cross-site Scripting – 2014-06-09 – 4 Sendmail Remote Code Execution Vulnerability in Concrete5 version 5.7.3.1 #59663 Valid Command and Code Injection – 2015-06-06 – 3 Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1 #59662 Valid Cross-site Scripting – 2016-06-26 – 3 Multiple Cross Site Request Forgery Vulnerabilities in Concrete5 version 5.7.3.1 #59660 Valid Cross-Site Request Forgery – 2016-06-26 – 3 Stored XSS in Feature tile #50639 Valid Cross-site Scripting – 2015-07-08 – 3