CVE-2023-44760

Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly.

• CWE-79

• https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1Issue Tracking
• https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodesExploit, Third Party Advisory
• https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766Third Party Advisory
• https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1Issue Tracking
• https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodesExploit, Third Party Advisory
• https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766Third Party Advisory

Published

Oct 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4475An Arbitrary File Movement vulnerability was found in ASUSTO…5.5
• CVE-2023-44752An issue in Student Study Center Desk Management System v1.0…9.8
• CVE-2023-44753A stored cross-site scripting (XSS) vulnerability fin Studen…6.1
• CVE-2023-44755Sacco Management system v1.0 was discovered to contain a SQL…9.8
• CVE-2023-44758GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) …5.4
• CVE-2023-4476The Locatoraid Store Locator WordPress plugin before 3.9.24 …6.1
• CVE-2023-44761Multiple Cross Site Scripting (XSS) vulnerabilities in Concr…5.4
• CVE-2023-44762A Cross Site Scripting (XSS) vulnerability in Concrete CMS f…5.4
• CVE-2023-44763Concrete CMS v9.2.1 is affected by an Arbitrary File Upload …5.4
• CVE-2023-44764A Cross Site Scripting (XSS) vulnerability in Concrete CMS b…5.4
• CVE-2023-44765A Cross Site Scripting (XSS) vulnerability in Concrete CMS v…5.4
• CVE-2023-44766A Cross Site Scripting (XSS) vulnerability in Concrete CMS v…4.8