Medium severity5.4NVD Advisory· Published Mar 18, 2021· Updated Jun 17, 2026
CVE-2021-28145
CVE-2021-28145
Description
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
concrete5/concrete5Packagist | < 8.5.5 | 8.5.5 |
Affected products
3- Concrete CMS/Concrete CMSdescription
Patches
Vulnerability mechanics
References
4- documentation.concrete5.org/developers/introduction/version-history/855-release-notesnvdRelease NotesVendor AdvisoryWEB
- github.com/advisories/GHSA-7388-7vq2-m4f4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-28145ghsaADVISORY
- www.concrete5.org/developers/securitynvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.