Medium severity6.1NVD Advisory· Published Apr 28, 2023· Updated Jun 17, 2026

CVE-2023-28475

Description

Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
concrete5/concrete5Packagist	< 9.2.0	9.2.0

Affected products

Concrete5/Concrete5
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
Range: <9.2.0
Concrete CMS/Concrete CMSdescription
ghsa-coords
pkg:composer/concrete5/concrete5
Range: < 9.2.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-vcpr-hm2m-gjjjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-28475ghsaADVISORY
www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20nvdVendor AdvisoryWEB
concretecms.comnvdProductWEB
github.com/concretecms/concretecms/commit/861ba66d248165c9ee9d6d11a0457908b97d68f0ghsaWEB
www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-releasenvdWEB

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000