Description
An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Remediation
References
Related Vulnerabilities
WordPress 7PK - Security Features Vulnerability (CVE-2014-9039)
WordPress Plugin Simple History Information Disclosure (2.7.4)
WordPress Plugin Twitter Feed:Embedded Timeline 'url' Parameter Cross-Site Scripting (0.3.1)
GlassFish CVE-2018-2911 Vulnerability (CVE-2018-2911)
WordPress Plugin Events Search For The Events Calendar Security Bypass (1.1.3)