Concretecms-community-store vulnerabilities
We track 2 vulnerabilities in Concretecms-community-store products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest Concretecms-community-store vulnerabilities
- 7.5 High severity
community_store: Generation of Predictable Numbers or Identifiers
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate val
- 8.1 High severity
community_store: Improper Neutralization of Input During Web Page Generation
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manage