https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 10:21:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-320093 EUVD-2026-320093 https://cve.radiocsirt.org/vuln/euvd-2026-320093 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8421 <p>Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.  An attacker who can cause an authenticated administrator to visit a crafted page,  and who has placed or caused a package to be present under DIR_PACKAGES/&lt;handle&gt;/, can force the installation of that package without any CSRF protection. Package installation executes the package controller&#39;s install() method as the web server user, enabling remote code execution.  In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks  https://github.com/maru1009  for reporting.</p> <p>Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.  An attacker who can cause an authenticated administrator to visit a crafted page,  and who has placed or caused a package to be present under DIR_PACKAGES/&lt;handle&gt;/, can force the installation of that package without any CSRF protection. Package installation executes the package controller&#39;s install() method as the web server user, enabling remote code execution.  In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks  https://github.com/maru1009  for reporting.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-8421 https://cve.radiocsirt.org/vuln/ghsa-4c8m-6fwx-m7xq <p><strong>Affected:</strong> Packagist: concrete5/concrete5</p> <p>Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.  An attacker who can cause an authenticated administrator to visit a crafted page,  and who has placed or caused a package to be present under DIR_PACKAGES/&lt;handle&gt;/, can force the installation of that package without any CSRF protection. Package installation executes the package controller&#39;s install() method as the web server user, enabling remote code execution.  In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team thanks @maru1009 for reporting this issue.</p> <p><strong>Affected:</strong> Packagist: concrete5/concrete5</p> <p>Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.  An attacker who can cause an authenticated administrator to visit a crafted page,  and who has placed or caused a package to be present under DIR_PACKAGES/&lt;handle&gt;/, can force the installation of that package without any CSRF protection. Package installation executes the package controller&#39;s install() method as the web server user, enabling remote code execution.  In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team thanks @maru1009 for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-4c8m-6fwx-m7xq