rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-3214 CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Drupal
product: CAPTCHA
default_status: unaffected
Credits: lang: en
value: Andrew Wang (andrew.wang)
lang: en
value: Andrew Belcher (andrewbelcher)
lang: en
value: Chris Dudley (dudleyc)
lang: en
value: M Parker (mparker17)
lang: en
value: tamasd
lang: en
value: Tim Wood (timwood)
lang: en
value: Denis K**** (dench0)
lang: en
value: Joshua Sedler (grevil)
lang: en
value: Jakob P (japerry)
lang: en
value: Adam Nagy (joevagyok)
lang: en
value: cilefen  (cilefen)
lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Michael Hess (mlhess)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:23:43.968Z
CVE-2026-3215 Islandora  - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: Islandora
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: Joe Corall (joecorall)
lang: en
value: Rosie Le Faive (rosiel)
lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:24:03.936Z
CVE-2026-3216 Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Drupal
product: Drupal Canvas
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: BÃ¡lint KlÃ©ri (balintbrews)
lang: en
value: Ignacio SÃ¡nchez Holgueras (isholgueras)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Narendra Singh Rathore (narendrar)
lang: en
value: Christian LÃ³pez EspÃ­nola (penyaskito)
lang: en
value: Tim Plunkett (tim.plunkett)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:24:17.937Z
CVE-2026-3217 SAML SSO - Service Provider  - Critical - Cross-site scripting - SA-CONTRIB-2026-018
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: SAML SSO - Service Provider
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: Sudhanshu Dhage (sudhanshu0542)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:24:30.977Z
CVE-2026-3218 Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: Responsive Favicons
default_status: unaffected
Credits: lang: en
value: Simon BÃ¤se (simonbaese)
lang: en
value: Frank Mably (mably)
lang: en
value: Sean Hamlin (wiifm)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:24:55.196Z
CVE-2026-3219 pip doesn't reject concatenated ZIP and tar archives
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
Affected products: vendor: Python Packaging Authority
product: pip
default_status: unaffected
Published: 2026-04-20T14:55:38.282Z
CVE-2026-3220 Multiple Plugins - Unauthenticated Stored XSS via Minify Library
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache  WordPress plugin before 2.4.2, Speed Optimizer  WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Autoptimize
default_status: unaffected
vendor: Unknown
product: Clearfy Cache
default_status: unaffected
vendor: Unknown
product: Speed Optimizer
default_status: unaffected
Credits: lang: en
value: Matthew Rollings
lang: en
value: WPScan
Published: 2026-05-18T06:00:08.130Z
CVE-2026-3221 
Sensitive
 user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with 
access to the database to obtain sensitive user 
information via direct database access.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-02-25T18:29:11.939Z
CVE-2026-3222 WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter
The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: flippercode
product: WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: JohSka
Published: 2026-03-11T05:27:17.281Z
CVE-2026-3223 Zip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web Designer
Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Google
product: Web Designer
default_status: unaffected
Published: 2026-02-27T13:12:38.809Z
CVE-2026-3224 
Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication, CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-03-03T21:21:27.611Z
CVE-2026-3225 LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check, and the QuestionAnswerModel::delete() method only validates minimum answer counts without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete answer options from any quiz question on the site.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: thimpress
product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Jack Pas
Published: 2026-03-23T22:25:40.557Z
CVE-2026-3226 LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: thimpress
product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Jack Pas
Published: 2026-03-12T02:22:37.026Z
CVE-2026-3227 Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N
A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command.  In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing.  
Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: TP-Link Systems Inc.
product: TL-WR802N v4
default_status: unaffected
vendor: TP-Link Systems Inc.
product: TL-WR841N v14
default_status: unaffected
vendor: TP Link Systems Inc.
product: TL-WR840N v6
default_status: unaffected
Credits: lang: en
value: do4choo (github.com/do4choo)
Published: 2026-03-13T21:38:31.666Z
CVE-2026-3228 NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping on the `snapFB` post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: nextscripts
product: NextScripts: Social Networks Auto-Poster
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Yudha - DJ
Published: 2026-03-10T09:58:59.045Z
CVE-2026-3229 Integer Overflow in Certificate Chain Allocation
An integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data was written out of bounds of an insufficiently sized certificate buffer. wolfssl_add_to_chain is called by these API: wolfSSL_CTX_add_extra_chain_cert, wolfSSL_CTX_add1_chain_cert, wolfSSL_add0_chain_cert. These API are enabled for 3rd party compatibility features: enable-opensslall, enable-opensslextra, enable-lighty, enable-stunnel, enable-nginx, enable-haproxy. This issue is not remotely exploitable, and would require that the application context loading certificates is compromised.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based buffer overflow
Affected products: vendor: wofSSL
product: wolfSSL
default_status: unaffected
Credits: lang: en
value: Kunyuk
lang: en
value: Pelioro
Published: 2026-03-19T21:07:05.871Z
CVE-2026-3230 Improper key_share validation in TLS 1.3 HelloRetryRequest
Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-protected communications via a crafted HelloRetryRequest followed by a ServerHello message that omits the required key_share extension, resulting in derivation of predictable traffic secrets from (EC)DHE shared secret. This issue does not affect the client's authentication of the server during TLS handshakes.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation Improper Input Validation
Affected products: vendor: wolfSSL
product: wolfSSL
default_status: unaffected
Credits: lang: en
value: Jaehun Lee, Pohang University of Science and Technology (POSTECH)
lang: en
value: Kyungmin Bae, Pohang University of Science and Technology (POSTECH)
Published: 2026-03-19T20:59:54.021Z
CVE-2026-3231 Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: themehigh
product: Checkout Field Editor (Checkout Manager) for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Dmitrii Ignatyev
Published: 2026-03-11T09:25:44.592Z
CVE-2026-3234 Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection
A flaw was found in  mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.
Problem types: cwe_id: CWE-93
description: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Core Services
cpes: cpe:/a:redhat:jboss_core_services:1
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Core Services
cpes: cpe:/a:redhat:jboss_core_services:1
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Coty Sutherland (@csutherl) (IBM) for reporting this issue.
Published: 2026-03-12T10:54:25.456Z
CVE-2026-3236 
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Octopus Deploy
product: Octopus Server
default_status: unaffected
Credits: lang: en
value: This vulnerability was found by nguyennb
Published: 2026-03-05T10:37:03.736Z
CVE-2026-3237 
In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.
Problem types: description: Low-Privilege User Can Modify Global Signing Key Settings
Affected products: vendor: Octopus Deploy
product: Octopus Server
default_status: unaffected
Credits: lang: en
value: This vulnerability was found by raihanadiarba
Published: 2026-03-17T06:37:59.369Z
CVE-2026-3238 Samba: denial of service against ad dc wins server
A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unknown
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Arad Inbar (DREAM Security Research Team), Ben Grinberg (DREAM Security Research Team), Erez Cohen (DREAM Security Research Team), and Nir Somech (DREAM Security Research Team) for reporting this issue.
Published: 2026-06-08T07:34:20.690Z
CVE-2026-3239 Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wpchill
product: Strong Testimonials
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Ronnachai Sretawat Na Ayutaya
Published: 2026-04-08T04:27:16.978Z
CVE-2026-3240 Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form
In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security
Published: 2026-03-04T02:15:53.400Z