CVE-2024-1246

Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9.

• CWE-20
• CWE-79

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notesRelease Notes, Vendor Advisory
• https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisoryVendor Advisory
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notesRelease Notes, Vendor Advisory
• https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisoryVendor Advisory

Published

Feb 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12452The Ziggeo plugin for WordPress is vulnerable to Stored Cros…5.4
• CVE-2024-12453The Uptodown APK Download Widget plugin for WordPress is vul…6.4
• CVE-2024-12454The Affiliate Program Suite — SliceWP Affiliates plugin for …6.1
• CVE-2024-12457The Chat Support for Viber – Chat Bubble and Chat Button for…6.4
• CVE-2024-12458The Smart PopUp Blaster plugin for WordPress is vulnerable t…6.4
• CVE-2024-12459The Ganohrs Toggle Shortcode plugin for WordPress is vulnera…6.4
• CVE-2024-12460The Years Since – Timeless Texts plugin for WordPress is vul…6.4
• CVE-2024-12461The WP-Revive Adserver plugin for WordPress is vulnerable to…6.4
• CVE-2024-12462The YOGO Booking plugin for WordPress is vulnerable to Store…6.4
• CVE-2024-12463The Arena.IM – Live Blogging for real-time events plugin for…5.4
• CVE-2024-12464The Chatroll Live Chat plugin for WordPress is vulnerable to…6.4
• CVE-2024-12465The Property Hive Stamp Duty Calculator plugin for WordPress…6.4