rootpwn

critical · CVSS v3 8.7 · CVSS v4 9.3

CVE-2026-93659

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and a…

Description

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
8.7
CVSS v4
9.3
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-93564

HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak allows memory exhaustion. The flaw resides in the handling of nested TLVs in the PROXY protocol. It can lead to denial of service on affected HAProxy instances.

View analysis

critical

CVE-2026-93565

CVE-2026-93565 allows an attacker to send RTSP requests with trailing control bytes that are silently stripped by RtspMethods.valueOf(), causing the server to treat them as valid method tokens. This flaw exists in Netty-based RTSP servers and can lead to unauthorized or malformed requests being accepted as legitimate. The vulnerability is critical with a CVSS v3 score of 9.8.

View analysis

critical

CVE-2026-93567

HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

View analysis

critical

CVE-2026-93569

HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

View analysis