CVE-2023-44766

A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from…

published October 6, 2023

CVSS
—
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00595 · 47.8th percentile
Published
2023-10-06T00:00Z
EPSS history
Timeline
  • 06 OCT 00:00Z
    A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from…
    cvelistv5