UpHeron
All vulnerabilities

Servers and applications

CVE-2023-44760

Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also,…

Severity
Medium 4.8
Published
23 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Concrete CMSServers and applications · cpe:a:concretecms:concrete_cms
  • Version 9.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-44760
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-44760