https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T19:30:12.651617+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-7881 fkie_cve-2026-7881 2026-11-11T19:30:12.653386+00:00

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

 https://db.gcve.eu/vuln/ghsa-chfm-cm6h-q5x7 GHSA-chfm-cm6h-q5x7 — Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block 2026-11-11T19:30:12.653466+00:00

Affected: Packagist: concrete5/concrete5

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team thanks Tristan Madani for reporting this issue.