Concrete CMS is prone to multiple cross-site scripting vulnerabilities, an arbitrary-file-upload vulnerability, and a denial-of-service vulnerability. An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.