Known vulnerabilities in concrete5 - page 3

Software: concrete5
Software CPE: cpe:2.3:a:portlandlabs:concrete5:*:*:*:*:*:*:*:*
Total vulnerabilities: 54
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting concrete5 concrete5 is affected by 54 known vulnerabilities: 1 high, 10 medium, 43 low Critical High Medium Low

Vulnerabilities (54)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU64525 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-21829
CWE-94 Low
No
No
8.5.8 21.06.2022 SB2022062104
#VU54995 - Deserialization of Untrusted Data
CVE-2021-36766
CWE-502 Medium
No
No
- 20.07.2021 SB2021072001
#VU51577 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3111
CWE-79 Low
Available
No
8.5.5 18.03.2021 SB2021031822
#VU51576 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-28145
CWE-79 Low
No
No
8.5.5 18.03.2021 SB2021031822
#VU46308 - Permissions, Privileges, and Access Controls
CVE-2020-24986
CWE-264 Low
No
No
8.5.3 07.09.2020 SB2020090707
#VU35826 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-19146
CWE-79 Low
No
No
- 17.06.2019 SB2019061712
#VU36933 - Server-Side Request Forgery (SSRF)
CVE-2018-13790
CWE-918 Medium
No
No
- 09.07.2018 SB2018070918
#VU38353 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-4721
CWE-79 Low
No
No
- 07.09.2017 SB2017090728
#VU38354 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2015-4724
CWE-89 High
No
No
- 07.09.2017 SB2017090728
#VU39141 - Cross-Site Request Forgery (CSRF)
CVE-2017-8082
CWE-352 Medium
No
No
- 24.04.2017 SB2017042418
#VU40967 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-9526
CWE-79 Low
No
No
- 05.01.2015 SB2015010502
#VU41454 - Exposure of sensitive information to an unauthorized actor
CVE-2014-5107
CWE-200 Medium
No
No
- 28.07.2014 SB2014072801
#VU41455 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-5108
CWE-79 Low
No
No
- 28.07.2014 SB2014072801
#VU43234 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-5181
CWE-79 Low
No
No
- 21.12.2012 SB2012122106


Showing elements 41 - 60 out of 54