Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3240 - Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form Intel Report: https://ift.tt/p0H1aK5
Post summary
Concrete CMS versions below 9.4.8 are vulnerable to stored XSS via legacy form, as reported in CVE-2026-3240.
CVE-2026-3240 Stored XSS Vulnerability in Concrete CMS Legacy Form Eleme... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3240 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post discloses a stored XSS vulnerability (CVE‑2026‑3240) in Concrete CMS legacy form elements, providing minimal technical details but no PoC, exploit, or patch information.
⚡ New CVE Alert: CVE-2026-3240 📊 Severity: 4.8 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-3240 #CVE-2026-3240 #CVE #Medium #CyberSecurity #InfoSec https://t.co/U4Lb47Wvni
Post summary
The tweet announces CVE-2026-3240 with a medium severity score of 4.8 but offers no further technical details, PoC, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | concretecms | concrete_cms | - | - | - |