Medium severity5.5NVD Advisory· Published Apr 28, 2023· Updated Jun 17, 2026

CVE-2023-28477

Description

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
concrete5/concrete5Packagist	< 9.2.0	9.2.0

Affected products

Concrete5/Concrete5
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
Range: <9.2.0
Concrete CMS/Concrete CMSdescription
ghsa-coords
pkg:composer/concrete5/concrete5
Range: < 9.2.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-xfmj-r86m-j2hrghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-28477ghsaADVISORY
www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20nvdVendor AdvisoryWEB
concretecms.comnvdProductWEB
github.com/concretecms/concretecms/commit/546cef6ec29208d5c079113635cd6e6b250e9f7cghsaWEB
www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-releasenvdWEB

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000