Concrete CMS versions below 9.5.3 contain a Cross-Site Request Forgery (CSRF) vulnerability in the dashboard SEO Excluded Words page. The reset() controller action that clears the reserved-word list does not validate the anti-CSRF token and does not restrict the request to POST, allowing an attacker to revert the reserved-word list to default silently. This could alter future URL slug generation, undoing the site's SEO slug policy. The vulnerability has a low severity score of 2.3 according to the Concrete CMS security team.