PT-2026-2973 · Packagist · Concrete5/Concrete5

Publicado 2026-01-14 · Atualizado 2026-01-14

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.

Exploit

Correção

Enumeração de Fraquezas

CWE-643

Identificadores relacionados

GHSA-R7VR-WG3F-8HR9

Produtos afetados

Concrete5/Concrete5

Referências · 8

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3 · Exploit
• https://github.com/concretecms/concretecms · Nota
• https://concretecms.org · Nota
• https://concretecms.org/download · Nota
• https://vulncheck.com/advisories/concrete-cme-xpath-injection · Nota
• https://osv.dev/vulnerability/GHSA-r7vr-wg3f-8hr9 · Aviso do Fabricante
• https://exploit-db.com/exploits/51144 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-50807 · Nota de Segurança