{"action":"No fix published. Pin and monitor.","affected":[],"component":"concrete5/concrete5","cve_ids":["CVE-2022-50807"],"ecosystem":"Packagist","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-r7vr-wg3f-8hr9","id":"tcs_01M5KF81YR2SZ7WB4AFNKX67K0","modified_at":"2026-02-03T02:58:55.506001Z","published_at":"2026-01-14T00:31:27Z","references":["https://osv.dev/vulnerability/GHSA-r7vr-wg3f-8hr9","https://nvd.nist.gov/vuln/detail/CVE-2022-50807","https://github.com/concretecms/concretecms","https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3","https://www.concretecms.org","https://www.concretecms.org/download","https://www.exploit-db.com/exploits/51144","https://www.vulncheck.com/advisories/concrete-cme-xpath-injection"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-r7vr-wg3f-8hr9","url":"https://osv.dev/vulnerability/GHSA-r7vr-wg3f-8hr9"}],"summary":"Concrete5 CMS contains an XPath injection vulnerability"}