V01Demort

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions prior to 9.5.3 **Description** Stored cross-site scripting occurs because Express entry labels are rendered as raw HTML when displaying associated entries. An unauthenticated attacker can submit a malicious payload through a public Express Form. This payload executes within an administrator's dashboard session when the associated entry is viewed, or in the browser of any visitor to a page utilizing an Express Entry List block with association columns, enabling actions to be performed with the privileges of that user. **Recommendations** Update Concrete CMS to version 9.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions 8.3.0 through 9.5.2 **Description** Stored calendar event names are saved without sanitization and rendered without HTML escaping in the workflow approval and deletion notifications within the dashboard "Waiting For Me" block. A registered user with permissions to add events to a calendar governed by an approval workflow can submit an event name containing a script payload. This payload executes in an administrator's browser when the pending request is displayed, potentially allowing the creation of a new administrator account. **Recommendations** Update Concrete CMS to a version later than 9.5.2.