CVE-2021-3111

MEDIUM

Concrete CMS < 8.5.5 - Stored Cross-Site Scripting via Express Entries Dashboard Name Field

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-3111. PoCs published by Quadron Research Lab.

AI-analyzed exploit summary This is a writeup describing a stored XSS vulnerability in Concrete5 CMS 8.5.4 via the 'name' field in the Express Entries Dashboard. The proof of concept is referenced in an external PDF.

Description

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

Exploits (1)

exploitdb WRITEUP
by Quadron Research Lab · textwebappsphp
https://www.exploit-db.com/exploits/49721

This is a writeup describing a stored XSS vulnerability in Concrete5 CMS 8.5.4 via the 'name' field in the Express Entries Dashboard. The proof of concept is referenced in an external PDF.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Concrete5 CMS 8.5.4
Auth required
Prerequisites: Access to the Express Entries Dashboard · Ability to create a new data object
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 4.8
EPSS 0.0301
EPSS Percentile 85.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
concretecms/concrete_cms < 8.5.5
Published Jan 08, 2021
Tracked Since Feb 18, 2026