CVE-2026-3242
Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
Résumé
Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web documentation.concretecms.org