A vulnerability, which was classified as critical, was found in Concrete CMS up to 9.5.0. The impacted element is an unknown function of the file /dashboard/reports/forms/legacy of the component URL Handler. Such manipulation leads to improper neutralization of script in attributes in a web page.
This vulnerability is listed as CVE-2026-8245. The attack may be performed from remote. There is no available exploit.
