CVE-2023-28821: Concretecms Concrete CMS

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

Affected products

• Concretecms Concrete CMS: before 9.1.0 (fixed in 9.1.0)

Published 2023-04-28. Last modified 2026-06-17.