CVE-2021-28145: Concretecms Concrete CMS

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

Affected products

• Concretecms Concrete CMS: before 8.5.5 (fixed in 8.5.5)

Published 2021-03-18. Last modified 2026-06-17.