CVE-2026-81896— Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label
Quick assessment
Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Concrete CMS 在 9.5.3 之前的版本中，在 Dashboard 的表单提交报告（ ）中，当将用户自定义的表单区块问题标签渲染为表格列标题时，未对其进行 HTML 实体编码。一个恶意编辑者可以在标签中存储标记或脚本，当任何管理员打开受影响表单的提交报告时，这些脚本会在其浏览器中执行，从而在 Dashboard 中产生存储型跨站脚本攻击（Stored XSS）。Concrete CMS 安全团队将此漏洞的 CVSS v4.0 评分定为 8.4，向量值为：CVSS:4.0/AV:N/AC:L/AT:N/P
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81896
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label
Source: CVE Program / CVE List V5
Vulnerability Description
Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report (concrete/single_pages/dashboard/reports/forms/legacy.php). a rogue editor could store markup or script in a label that then executes in the browser of any administrator who opens the submissions report for the affected form, producing stored cross-site scripting in the Dashboard. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Concrete CMS | Concrete CMS | 5.0.0 ~ 9.5.2 | - |
|
II. Public POCs for CVE-2026-81896
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81896
请登录查看更多情报信息。
Vendor Pages for CVE-2026-81896 (1)
-
🔗 Page Not Found :: Concrete CMS release-notes
Same Patch Batch · Concrete CMS · 2026-09-15 · 17 CVEs total
| CVE-2026-18110 | 8.7 HIGH | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user select |
| CVE-2026-81895 | 8.5 HIGH | Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Documen |
| CVE-2026-81894 | 8.5 HIGH | Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) |
| CVE-2026-18111 | 8.5 HIGH | Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning gr |
| CVE-2026-81897 | 7.7 HIGH | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control |
| CVE-2026-81898 | 7.5 HIGH | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address att |
| CVE-2026-18113 | 7.5 HIGH | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via |
| CVE-2026-18115 | 7.4 HIGH | In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and chang |
| CVE-2026-81899 | 7.3 HIGH | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members |
| CVE-2026-81919 | 2.3 LOW | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arran |
| CVE-2026-68533 | 2.3 LOW | Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows |
| CVE-2026-68534 | 2.3 LOW | Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in |
| CVE-2026-68532 | 2.3 LOW | Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashb |
| CVE-2026-81920 | 2.3 LOW | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard S |
| CVE-2026-81921 | 2.3 LOW | In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status |
| CVE-2026-81922 | 2.1 LOW | "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder a |
IV. Related Vulnerabilities
Same product: Concrete CMS
-
CVE-2026-81922
"In Concrete CMS below 9.5.3, there is Missing authorization -
CVE-2026-81921
In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Gran -
CVE-2026-81920
Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request -
CVE-2026-68532
Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete -
CVE-2026-68533
Missing Authorization in Concrete CMS versions below 9.5.3 C
Same vendor: Concrete CMS
-
CVE-2026-81922
"In Concrete CMS below 9.5.3, there is Missing authorization -
CVE-2026-81921
In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Gran -
CVE-2026-81920
Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request -
CVE-2026-68532
Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete -
CVE-2026-68533
Missing Authorization in Concrete CMS versions below 9.5.3 C
Same weakness: CWE-79
-
CVE-2026-68534
Concrete CMS below 9.5.2 is vulnerable to Stored XSS via une -
CVE-2026-81899
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via gr -
CVE-2026-18113
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the -
CVE-2026-81898
Concrete CMS below version 9.5.3 is vulnerable to Stored XS -
CVE-2026-12749
Multiple security vulnerabilities are addressed with IBM Clo
V. Comments for CVE-2026-81896
No comments yet