PT-2026-22862 · Unknown · Concrete Cms

Zolpak · Publicado 2026-03-04 · Atualizado 2026-03-04 · CVE-2026-3244

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.4.8

Description A stored cross-site scripting (XSS) issue exists in the search block of the software. Page names and content are rendered without proper HTML encoding in search results, allowing authenticated administrators to inject malicious JavaScript through page names. This JavaScript executes when users search for and view those pages in search results.

Recommendations Update to version 9.4.8 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3244

GHSA-MM5F-5RQW-574F

Produtos afetados

Concrete Cms

Referências · 10

• https://github.com/concretecms/concretecms · Nota
• https://github.com/concretecms/concretecms/pull/12826 · Aviso do Fabricante
• https://t.me/CVEtracker/46271 · Publicação no Telegram
• https://t.me/cveNotify/154224 · Publicação no Telegram
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mm5f-5rqw-574f · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3244 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2029034299555541411 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3244 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2029168108888572005 · Publicação no Twitter