← All credits
winstoncrooker
4 vulnerability records and advisories credit this contributor.
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
CVE-2026-81908
Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups
CVE-2026-84432
Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller
CVE-2026-68527
Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog