TLDRVuln - Cybersecurity Vulnerabilities Made Simple

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection

Medium · published May 21, 2026

CVSS v4.0

6.0

EPSS

Percentile

13.8

In the wild

Unconfirmed

What it is

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" (<a href="{$linkURL}" …>). Any authenticated admin or report viewer with access to `/dashboard/reports/forms/legacy` who clicks the crafted URL fires the payload in their session. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting

The record

Technical detail

CVSS v4.0: 6.0 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00236 · 13.8th percentile
Weakness: CWE-83 · Improper Neutralization of Script in Attributes in a Web Page
Published: 2026-05-21T21:14Z

EPSS history

Timeline

21 MAY 21:14Z
Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection
cvelistv5