CVE-2024-3178

Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator .

• CWE-79
• CWE-79

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.Release Notes
• https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA.Release Notes
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.Release Notes
• https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA.Release Notes

Published

Apr 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31759An issue in sanluan PublicCMS v.4.0.202302.e allows an attac…8.8
• CVE-2024-3176Out of bounds write in SwiftShader in Google Chrome prior to…8.8
• CVE-2024-31760An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allow…4.7
• CVE-2024-3177A security issue was discovered in Kubernetes where users ma…2.7
• CVE-2024-31771Insecure Permission vulnerability in TotalAV v.6.0.740 allow…7.8
• CVE-2024-31777File Upload vulnerability in openeclass v.3.15 and before al…9.8
• CVE-2024-31783Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 a…6.1
• CVE-2024-31784An issue in Typora v.1.8.10 and before, allows a local attac…6.1
• CVE-2024-3179Concrete CMS version 9 before 9.2.8 and previous versions be…4.8
• CVE-2024-31798Identical Hardcoded Root Password for All Devices in GNCC's …6.8
• CVE-2024-31799Information Disclosure in GNCC's GC2 Indoor Security Camera …4.6
• CVE-2024-3180Concrete CMS version 9 below 9.2.8 and previous versions bel…4.8