Concrete CMS versions 9.5.0 and earlier allow stored cross‑site scripting through the cvName field on external‑link pages because the updateCollectionAliasExternal function bypasses input sanitization. The attacker can persist malicious script code that runs whenever users view the page, enabling session hijacking, content defacement or data exfiltration. The CVSS score of 2.0 indicates a low severity but the stored nature of the flaw means the malicious code will execute in the browsers of any user who loads the vulnerable page.

Concrete CMS, specifically all releases 9.5.0 through 9.5.0, are affected. No patch version is listed in the advisory, so any installation that has not been upgraded beyond 9.5.0 remains vulnerable.

With a CVSS score of 2.0 and no EPSS data, the probability of exploitation is not quantified. The flaw is not listed in CISA KEV, suggesting no publicly known exploit. Attackers would need administrative or content‑editor privileges to modify the cvName field and then browse the affected page to trigger the payload, making the practical risk moderate but still warranting remediation.