CVE-2022-30118

Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.

• CWE-79
• CWE-79

• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1370054Permissions Required, Third Party Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1370054Permissions Required, Third Party Advisory

Published

Jun 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30110The file preview functionality in Jirafeau < 4.4.0, which is…6.1
• CVE-2022-30111Due to the use of an insecure algorithm for rolling codes in…6.8
• CVE-2022-30113Electronic mall system 1.0_build20200203 is affected vulnera…9.8
• CVE-2022-30114A heap-based buffer overflow in a network service in Fastweb…7.5
• CVE-2022-30115Using its HSTS support, curl can be instructed to use HTTPS …4.3
• CVE-2022-30117Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0…9.1
• CVE-2022-30119XSS in /dashboard/reports/logs/view - old browsers only. Whe…6.1
• CVE-2022-3012A vulnerability was found in oretnom23 Fast Food Ordering Sy…8.8
• CVE-2022-30120XSS in /dashboard/blocks/stacks/view_details/ - old browsers…6.1
• CVE-2022-30121The “LANDesk(R) Management Agent” service exposes a socket a…6.7
• CVE-2022-30122A possible denial of service vulnerability exists in Rack <2…7.5
• CVE-2022-30123A sequence injection vulnerability exists in Rack <2.0.9.1, …10