{"cve":"CVE-2023-44760","nvd":{"published":"2023-10-23T22:15:09.257","modified":"2026-06-17T06:27:46.433","status":"Modified","description":"Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by \"sromanhu\" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","score":4.8},"cwes":["CWE-79"],"references":["https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1","https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodes","https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766","https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1","https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodes"],"products":["concretecms:concrete_cms"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-44760","score":0.00701,"percentile":0.53248,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}