Reflected Cross-Site Scripting Vulnerability in Concrete CMS by Concrete5

CVE-2025-8571

What is CVE-2025-8571?

Concrete CMS versions 9 through 9.4.2, and versions earlier than 8.5.21, are prone to a Reflected Cross-Site Scripting (XSS) vulnerability in the Conversation Messages Dashboard Page. This flaw arises from unsanitized input, potentially allowing attackers to steal session cookies or tokens, deface web content, redirect users to malicious sites, and if triggered by an admin, execute unauthorized actions. This vulnerability highlights the importance of web application security and the need for prompt updates.

References