Medium severity4.8NVD Advisory· Published Jan 8, 2021· Updated Jun 17, 2026

CVE-2021-3111

Description

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Concrete5/Concrete52 versions
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*range: <8.5.5
- (no CPE)range: = 8.5.4
Concrete5/Concrete5description

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.htmlnvdExploitThird Party AdvisoryVDB Entry
github.com/Quadron-Research-Lab/CVE/blob/main/CVE-2021-3111.pdfnvdExploitThird Party Advisory
packetstormsecurity.com/files/161997/Concrete5-8.5.4-Cross-Site-Scripting.htmlnvdThird Party AdvisoryVDB Entry
documentation.concrete5.org/developers/introduction/version-historynvdRelease NotesVendor Advisory
documentation.concrete5.org/developers/introduction/version-history/855-release-notesnvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000