PT-2026-22865 · Unknown · Concrete Cms

Minhnn42 + 2 · Publicado 2026-03-04 · Atualizado 2026-03-04 · CVE-2026-3240

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.4.8

Description A user with edit permissions on a page containing a Legacy form can execute a stored Cross-Site Scripting (XSS) attack targeting high-privilege accounts through the Question field. This allows an attacker to inject malicious scripts that execute within the context of another user's browser.

Recommendations Update to version 9.4.8 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3240

GHSA-45FJ-FVMM-XCC5

Produtos afetados

Concrete Cms

Referências · 10

• https://github.com/concretecms/concretecms · Nota
• https://github.com/concretecms/concretecms/pull/12826 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2029190442512687290 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3240 · Nota de Segurança
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2029061299716407355 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3240 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2029168772498768080 · Publicação no Twitter
• https://t.me/CVEtracker/46274 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-45fj-fvmm-xcc5 · Aviso do Fabricante