CVE-2026-93659Patch

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-93659

Full discourse1 post

CVE@CVEnew46d
Patch
CVE-2026-93659 Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can stor… https://www.cve.org/CVERecord?id=CVE-2026-93659
Post summary
The text discloses a stored XSS vulnerability in Concrete CMS Community Store due to missing HTML escaping on customer-supplied order fields and implies version 2.7.8 as the fixed release. It does not reference a PoC, exploit tool, or active exploitation.
000001.6K
58.1K followersView on X

Explore more

Back to dashboard