CVE-2021-40100

MEDIUM

Concrete CMS < 8.5.5 - Stored Cross-Site Scripting in Conversations Rich Text Editor

Title source: llm

EIP tracks 1 public exploit for CVE-2021-40100. PoCs published by bl4de.

An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text.

github NO CODE

by bl4de · poc

Core 2

Core References

Permissions Required, Third Party Advisory x_refsource_misc

Release Notes, Vendor Advisory x_refsource_misc

CVSS v3 5.4

EPSS 0.0050

EPSS Percentile 38.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79

Status published

Products (1)

concretecms/concrete_cms < 8.5.5

Published Sep 24, 2021

Tracked Since Feb 18, 2026