CVE-2025-3153

Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified.  Attackers are limited to individuals whom a site administrator has granted the ability to fill in an address attribute. It is possible for the attacker to glean limited information from the site but amount and type is restricted by mitigating controls and the level of access of the attacker. Limited data modification is possible. The dashboard page itself could be rendered unavailable. The fix only sanitizes new data uploaded post update to Concrete CMS 9.4.0RC2. Existing database entries added before the update will still be “live” if there were successful exploits added under previous versions; a database search is recommended. The Concrete CMS security team gave this vulnerability CVSS v.4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L Thanks Myq Larson for reporting.

• CWE-79
• CWE-352

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/940-release-notesRelease Notes
• https://github.com/concretecms/concretecms/pull/12511Issue Tracking, Patch
• https://github.com/concretecms/concretecms/pull/12512Issue Tracking, Patch
• https://github.com/concretecms/concretecms/releases/tag/8.5.20Release Notes

Published

Apr 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-31524Incorrect Privilege Assignment vulnerability in John James J…8.8
• CVE-2025-31525Missing Authorization vulnerability in WP Messiah WP Mobile …4.3
• CVE-2025-31526Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2025-31527Server-Side Request Forgery (SSRF) vulnerability in Kishan W…6.4
• CVE-2025-31528Missing Authorization vulnerability in wokamoto StaticPress …4.3
• CVE-2025-31529Missing Authorization vulnerability in Rashid Slider Path fo…4.3
• CVE-2025-31530Missing Authorization vulnerability in Smackcoders Inc., Goo…4.3
• CVE-2025-31531Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2025-31532Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-31533Missing Authorization vulnerability in Salesmate.io Salesmat…5.3
• CVE-2025-31534Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2025-31535Improper Neutralization of Input During Web Page Generation …6.5