CVE-2021-3111

4.8 MEDIUM

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/expr...

Published: 2021-01-08 · Last updated: 2026-06-17

Severity and scoring

CVSS: 4.8 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

Affected products

Vendor	Product
concretecms	concrete_cms

Description

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3111
[Exploit reference]http://packetstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.html
[Other]http://packetstormsecurity.com/files/161997/Concrete5-8.5.4-Cross-Site-Scripting.html
[Vendor advisory]https://documentation.concrete5.org/developers/introduction/version-history
[Vendor advisory]https://documentation.concrete5.org/developers/introduction/version-history/855-release-notes
[Exploit reference]https://github.com/Quadron-Research-Lab/CVE/blob/main/CVE-2021-3111.pdf
[Exploit reference]http://packetstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.html
[Other]http://packetstormsecurity.com/files/161997/Concrete5-8.5.4-Cross-Site-Scripting.html
[Vendor advisory]https://documentation.concrete5.org/developers/introduction/version-history
[Vendor advisory]https://documentation.concrete5.org/developers/introduction/version-history/855-release-notes
[Exploit reference]https://github.com/Quadron-Research-Lab/CVE/blob/main/CVE-2021-3111.pdf

Related CVEs

Same vendor

CVE-2026-8340 — Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion (4.3 MEDIUM)
CVE-2026-8434 — Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() (8.8 HIGH)
CVE-2026-8433 — Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() (8.8 HIGH)
CVE-2026-8432 — Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() (8.8 HIGH)
CVE-2026-8427 — Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder(... (8.8 HIGH)

Same CWE

CVE-2026-12425 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access ...
CVE-2024-30476 — PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager (5.4 MEDIUM)
CVE-2026-54198 — Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions (7.1 HIGH)
CVE-2026-54191 — Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions (7.1 HIGH)
CVE-2026-39437 — Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions (7.1 HIGH)