community_store vulnerabilities

2 known vulnerabilities in community_store from Concretecms-community-store. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  community_store: Generation of Predictable Numbers or Identifiers

  CVE-2026-95653Sep 22, 2026Concretecms-community-store

  Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate val

• 8.1 High severity

  community_store: Improper Neutralization of Input During Web Page Generation

  CVE-2026-93659Sep 18, 2026Concretecms-community-store

  Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manage