CVE-2026-8245

The record

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" (<a href="{$linkURL}" …>). Any authenticated admin or report viewer with access to `/dashboard/reports/forms/legacy` who clicks the crafted URL fires the payload in their session. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting

Affected packages

Related vulnerabilities

• CVE-2026-45118 MyBB is free and open source forum software. CWE-83
• CVE-2026-15920 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. CWE-83
• CVE-2026-62324 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. CWE-83
• CVE-2026-49276 Kirby is an open-source content management system. CWE-83
• CVE-2026-48591 Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave… CWE-83
• GHSA-6xcg-6q43-rj2v Duplicate Advisory: Exported session HTML could keep unsafe markdown links CWE-83
• CVE-2026-53841 OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported… CWE-83
• GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL CWE-83