Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page names that executes when users search for and view those pages in search results. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks zolpak for reporting
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚡ New CVE Alert: CVE-2026-3244 📊 Severity: 4.8 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-3244 #CVE-2026-3244 #CVE #Medium #CyberSecurity #InfoSec https://t.co/uwBiU3KBZN
Post summary
A brief tweet announces the new CVE‑2026‑3244, noting its medium severity and linking to the NVD entry, without providing exploit details or mitigation guidance.
CVE-2026-3244 Stored Cross-Site Scripting Vulnerability in Concrete CMS Search Block Below 9.4.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3244
Post summary
A stored XSS vulnerability (CVE-2026-3244) exists in Concrete CMS Search Block versions below 9.4.8.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | concretecms | concrete_cms | - | - | - |