CVE-2024-1247
Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
- Published
- Feb 9, 2024
- Updated
- Aug 1, 2024
- Assigning CNA
- ConcreteCMS
- Evidence observed
- Aug 5, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NLow · next 30 days
- Percentile
- 67.5%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Concrete versions below 9 do not include group types so they are not affected by this vulnerability.
Sources
1- CVE-2024-1247-PoCExploit
Post Saint <= 1.3.1 plugin for WordPress Arbitrary File Upload
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.