Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| concrete5/concrete5(Packagist) | 0 | 8.5.5 | N/A |
CVSS Metrics
