Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
No PoCs from references.
- https://github.com/ARPSyndicate/cvemon