Vulnerabilities

TI-2026-20295 CVE-2026-25133 · GHSA-gcqv-f29m-67gr

October CMS has Stored XSS via SVG Filter Bypass

LOW 21

October is a Content Management System (CMS) and web platform.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00217 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-79

TI-2026-20288 CVE-2026-25125 · GHSA-g6v3-wv4j-x9hg

October CMS: Environment Variable Exfiltration via INI Parser Interpolation

LOW 22

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00326 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-200

TI-2026-20092 CVE-2026-24907 · GHSA-j4j5-9x6g-rgxc

October CMS has Stored XSS via Event Log Mail Preview

LOW 23

October is a Content Management System (CMS) and web platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00198 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-79

TI-2026-20091 CVE-2026-24906 · GHSA-6qmh-j78v-ffp7

October CMS has Stored XSS in its Backend Editor Markup Classes

LOW 23

October is a Content Management System (CMS) and web platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00252 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-79

TI-2026-18219 CVE-2026-22692 · GHSA-m5qg-jc75-4jp6

October CMS: Twig Sandbox Bypass via Collection Methods

LOW 30

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00395 Published 2026-04-14 Fixed in 3.7.13, 4.1.5 CWE-284

TI-2025-38106 CVE-2025-61674 · GHSA-gxxc-m74c-f48x

October CMS Vulnerable to Stored XSS via Editor and Branding Styles

LOW 29

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00274 Published 2026-01-10 Fixed in 4.0.12, 3.7.13 CWE-79

TI-2025-38108 CVE-2025-61676 · GHSA-wvpq-h33f-8rp6

October CMS Vulnerable to Stored XSS via Branding Styles

LOW 29

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00274 Published 2026-01-10 Fixed in 4.0.12, 3.7.13 CWE-79

TI-2024-34879 CVE-2024-51991 · GHSA-96hh-8hx5-cpw7

October CMS Allows Unprotected SVG Rename in Media Manager

LOW 7

October is a Content Management System (CMS) and web platform.

CVSS 4.0LOW 1.1 Network High privileges User interaction EPSS 0.00389 Published 2025-05-05 Fixed in 3.7.5 CWE-434

TI-2024-30847 CVE-2024-45962 · GHSA-hxpp-g76m-qhvg

October 3.6.30 allows an authenticated admin account to upload a PDF file containing…

MEDIUM 55

October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00513 Published 2024-10-02 No fix listed CWE-79

TI-2024-16964 CVE-2024-25837 · GHSA-wcrf-58c6-27cg

A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8…

LOW 24

A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0024 Published 2024-08-16 No fix listed CWE-79

TI-2024-16865 CVE-2024-25637 · GHSA-rjw8-v7rr-r563

Reflected XSS via X-October-Request-Handler Header

LOW 24

October is a self-hosted CMS platform based on the Laravel PHP Framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00263 Published 2024-06-26 Fixed in 3.5.15 CWE-79

TI-2024-16281 CVE-2024-24764 · GHSA-v2vf-jv88-3fp5

October Open Redirect for Administrator Accounts

LOW 22

October is a self-hosted CMS platform based on the Laravel PHP Framework.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00265 Published 2024-06-26 Fixed in 3.5.15 CWE-601

TI-2023-10724 CVE-2023-25365 · GHSA-gcgj-qh8p-57hm

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to…

LOW 34

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00355 Published 2024-02-08 No fix listed CWE-434

TI-2023-23887 CVE-2023-44381 · GHSA-q22j-5r3g-9hmh

October CMS safe mode bypass using Page template injection

LOW 23

October is a Content Management System (CMS) and web platform to assist with development workflow.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00511 Published 2023-12-01 Fixed in 3.4.15 CWE-94

TI-2023-23888 CVE-2023-44382 · GHSA-p8q3-h652-65vx

October CMS safe mode bypass using Twig sandbox escape

MEDIUM 41

October is a Content Management System (CMS) and web platform to assist with development workflow.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00873 Published 2023-12-01 Fixed in 3.4.15 CWE-94

TI-2023-23889 CVE-2023-44383 · GHSA-rvx8-p3xp-fj3p

October CMS stored XSS by authenticated backend user with improper configuration

LOW 25

October is a Content Management System (CMS) and web platform to assist with development workflow.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0041 Published 2023-11-29 Fixed in 3.5.2 CWE-79

TI-2023-23545 CVE-2023-43876

A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an…

MEDIUM 58

A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00477 Published 2023-09-28 No fix listed CWE-79

TI-2023-19223 CVE-2023-37692 · GHSA-r47v-rxcg-p28j

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute…

MEDIUM 58

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2023-07-26 No fix listed CWE-79

TI-2022-16371 CVE-2022-35944 · GHSA-x4q7-m6fp-4v9v

October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)

LOW 36

October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01051 Published 2022-10-13 Fixed in 3.0.66, 2.2.34 CWE-94

TI-2022-08613 CVE-2022-24800 · GHSA-8v7h-cpc2-r8jp

Race Condition in October CMS upload process

MEDIUM 40

October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01462 Published 2022-07-12 Fixed in 1.0.476, 1.1.12 +1 CWE-362

TI-2022-07707 CVE-2022-23655 · GHSA-53m6-44rc-h2q5

Missing server signature validation in OctoberCMS

LOW 25

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00644 Published 2022-02-23 Fixed in 1.1.11, 1.0.475 CWE-347

TI-2022-06081 CVE-2022-21705 · GHSA-79jw-2f46-wv22

Authenticated remote code execution in octobercms

MEDIUM 45

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0865 Published 2022-02-23 Fixed in 1.0.474, 1.1.10 +1 CWE-74

TI-2021-12317 CVE-2021-32649 · GHSA-wv23-pfj7-2mjj

Authenticated file write leads to remote code execution in october/system

MEDIUM 43

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0138 Published 2022-01-14 Fixed in 1.0.473, 1.1.6 CWE-74

TI-2021-12318 CVE-2021-32650 · GHSA-5hfj-r725-wpc4

Arbitrary code execution in october/system

HIGH 73

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02156 Published 2022-01-14 Fixed in 1.0.473, 1.1.6 CWE-74

TI-2021-17965 CVE-2021-41126 · GHSA-6gjf-7w99-j7x7

Deleted Admin Can Sign In to Admin Interface

LOW 34

October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01091 Published 2021-10-06 Fixed in 2.1.12 CWE-287

Vulnerabilities

Filters