CVE-2026-8197

MediumCVSS 4.8/10Last modified Jul 23, 2026

Description

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The <strong>...</strong> wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N  Thanks Yonatan Drori (Tenzai) for reporting.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-819717.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker toCVE-2026-819737.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-819757.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-819767.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-819775.5Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An CVE-2026-819785.5Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverCVE-2026-819797.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-81985.3The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication BypassCVE-2026-819807.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-819817.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-819825.5Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverCVE-2026-819837.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre
CVE-2026-8197: Medium severity, CVSS 4.8 | Vulnix