Vulnerabilities > Concretecms > Concrete CMS > 8.5.13

DATE CVE VULNERABILITY TITLE RISK
2023-04-28 CVE-2023-28821 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Concretecms Concrete CMS
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
network
low complexity
concretecms CWE-640
5.3
5.3
2022-02-09 CVE-2021-22954 Cross-Site Request Forgery (CSRF) vulnerability in Concretecms Concrete CMS
A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
network
low complexity
concretecms CWE-352
8.8
8.8