CVE-2021-3111: Concretecms Concrete CMS

Medium severity, CVSS 4.8. EPSS: 3% chance of exploitation in the next 30 days.

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

Affected products

• Concretecms Concrete CMS: before 8.5.5 (fixed in 8.5.5)

Published 2021-01-08. Last modified 2026-06-17.