UpHeron
All vulnerabilities

Servers and applications

CVE-2025-3153

Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified.  Attackers are limited to individuals whom a site administrator has granted the ability to fill in an address attribute. It is possible for the attacker to glean limited…

Severity
Medium 5.1
Published
3 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.5.20, 9.4.0
Sources
NVD

Affected software

SoftwareAffected versions
Concrete CMSServers and applications · cpe:a:concretecms:concrete_cms
  • Every version before 8.5.20
  • From 9.0 before 9.4.0
  • Version 9.4.0-rc1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-3153
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-3153