CVE-2023-48649

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notesRelease Notes
https://documentation.concretecms.org/developers/introduction/version-history/922-release-notesRelease Notes
https://github.com/concretecms/concretecms/pull/11695Issue Tracking, Patch
https://github.com/concretecms/concretecms/pull/11739Patch
https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-releaseRelease Notes, Vendor Advisory
https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notesRelease Notes
https://documentation.concretecms.org/developers/introduction/version-history/922-release-notesRelease Notes
https://github.com/concretecms/concretecms/pull/11695Issue Tracking, Patch
https://github.com/concretecms/concretecms/pull/11739Patch
https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-releaseRelease Notes, Vendor Advisory

Timeline

Published: Nov 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-48658.8A vulnerability has been found in SourceCodester Take-Note App 1.0 and classified as problematic. This vulnerability affects unknown code. T CVE-2023-486504.8Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.CVE-2023-486514.3Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit.CVE-2023-486524.3Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker c CVE-2023-486534.3Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An atta CVE-2023-486549.8One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the CVE-2023-486559.8An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query paramet CVE-2023-486569.8An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.CVE-2023-486579.8An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.CVE-2023-486589.8An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, peri CVE-2023-486599.8An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing.CVE-2023-48669.8A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the