PT-2026-22867 · Unknown · Concrete Cms

M3Dium · Publicado 2026-03-04 · Atualizado 2026-03-04 · CVE-2026-3242

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.4.8

Description A malicious administrator can inject stored cross-site scripting (XSS) through the Switch Language block. This allows an attacker to execute scripts in the context of another user's browser.

Recommendations Update to version 9.4.8 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3242

GHSA-W9QG-CHFH-G3Q9

Produtos afetados

Concrete Cms

Referências · 10

• https://github.com/concretecms/concretecms · Nota
• https://github.com/concretecms/concretecms/pull/12826 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2029169210828702202 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3242 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w9qg-chfh-g3q9 · Aviso do Fabricante
• https://t.me/CVEtracker/46276 · Publicação no Telegram
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-3242 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2029061295886987314 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2029185322328740080 · Publicação no Twitter