Vulnerabilities

Filters

1 selected

64 records

Sort

Vendor: October CMS Clear all filters

TI-2026-36565 CVE-2026-49400 · GHSA-2ff2-mx52-q8wp

October CMS: PHP Object Injection via Backend Widget Session Storage

LOW 16

October System provides the system module for October Content Management System.

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00237 Published 2026-09-14 Fixed in 3.7.17, 4.2.23 CWE-502

TI-2026-34325 CVE-2026-46696 · GHSA-xv9m-fm3w-8w5x

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

LOW 16

October System provides the system module for October Content Management System.

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00273 Published 2026-09-14 Fixed in 3.7.17, 4.2.23 CWE-269

TI-2026-23296 CVE-2026-29179 · GHSA-jvwg-phxx-j3rp

October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations

LOW 15

October is a Content Management System (CMS) and web platform.

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00144 Published 2026-04-21 Fixed in 4.1.16, 3.7.16 CWE-863

TI-2026-22281 CVE-2026-27937 · GHSA-jj38-h5w5-mvpf

October: Reflected XSS via DataTable Form Widget

LOW 14

October is a Content Management System (CMS) and web platform.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00144 Published 2026-04-21 Fixed in 4.1.16, 3.7.16 CWE-79

TI-2026-21244 CVE-2026-26274 · GHSA-h6jm-f4hh-fw27

October: Safe Mode Bypass via Twig Database Write Operations

LOW 31

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00229 Published 2026-04-21 Fixed in 4.1.10, 3.7.14 CWE-184

TI-2026-21071 CVE-2026-26067 · GHSA-3888-q23f-x7qh

October: Safe Mode Bypass via CSS Preprocessor Compilers

LOW 22

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00246 Published 2026-04-21 Fixed in 4.1.10, 3.7.14 CWE-184

TI-2026-20295 CVE-2026-25133 · GHSA-gcqv-f29m-67gr

October CMS has Stored XSS via SVG Filter Bypass

LOW 21

October is a Content Management System (CMS) and web platform.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00217 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-79

TI-2026-20288 CVE-2026-25125 · GHSA-g6v3-wv4j-x9hg

October CMS: Environment Variable Exfiltration via INI Parser Interpolation

LOW 22

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00326 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-200

TI-2026-20092 CVE-2026-24907 · GHSA-j4j5-9x6g-rgxc

October CMS has Stored XSS via Event Log Mail Preview

LOW 23

October is a Content Management System (CMS) and web platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00198 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-79

TI-2026-20091 CVE-2026-24906 · GHSA-6qmh-j78v-ffp7

October CMS has Stored XSS in its Backend Editor Markup Classes

LOW 23

October is a Content Management System (CMS) and web platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00252 Published 2026-04-14 Fixed in 3.7.14, 4.1.10 CWE-79

TI-2026-18219 CVE-2026-22692 · GHSA-m5qg-jc75-4jp6

October CMS: Twig Sandbox Bypass via Collection Methods

LOW 30

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00395 Published 2026-04-14 Fixed in 3.7.13, 4.1.5 CWE-284

TI-2025-38106 CVE-2025-61674 · GHSA-gxxc-m74c-f48x

October CMS Vulnerable to Stored XSS via Editor and Branding Styles

LOW 29

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00274 Published 2026-01-10 Fixed in 4.0.12, 3.7.13 CWE-79

TI-2025-38108 CVE-2025-61676 · GHSA-wvpq-h33f-8rp6

October CMS Vulnerable to Stored XSS via Branding Styles

LOW 29

October is a Content Management System (CMS) and web platform.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00274 Published 2026-01-10 Fixed in 4.0.12, 3.7.13 CWE-79

TI-2024-34879 CVE-2024-51991 · GHSA-96hh-8hx5-cpw7

October CMS Allows Unprotected SVG Rename in Media Manager

LOW 7

October is a Content Management System (CMS) and web platform.

CVSS 4.0LOW 1.1 Network High privileges User interaction EPSS 0.00389 Published 2025-05-05 Fixed in 3.7.5 CWE-434

TI-2024-30847 CVE-2024-45962 · GHSA-hxpp-g76m-qhvg

October 3.6.30 allows an authenticated admin account to upload a PDF file containing…

MEDIUM 55

October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00513 Published 2024-10-02 No fix listed CWE-79

TI-2024-16964 CVE-2024-25837 · GHSA-wcrf-58c6-27cg

A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8…

LOW 24

A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0024 Published 2024-08-16 No fix listed CWE-79

TI-2024-16865 CVE-2024-25637 · GHSA-rjw8-v7rr-r563

Reflected XSS via X-October-Request-Handler Header

LOW 24

October is a self-hosted CMS platform based on the Laravel PHP Framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00263 Published 2024-06-26 Fixed in 3.5.15 CWE-79

TI-2024-16281 CVE-2024-24764 · GHSA-v2vf-jv88-3fp5

October Open Redirect for Administrator Accounts

LOW 22

October is a self-hosted CMS platform based on the Laravel PHP Framework.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00265 Published 2024-06-26 Fixed in 3.5.15 CWE-601

TI-2023-10724 CVE-2023-25365 · GHSA-gcgj-qh8p-57hm

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to…

LOW 34

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00355 Published 2024-02-08 No fix listed CWE-434

TI-2023-23887 CVE-2023-44381 · GHSA-q22j-5r3g-9hmh

October CMS safe mode bypass using Page template injection

LOW 23

October is a Content Management System (CMS) and web platform to assist with development workflow.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00511 Published 2023-12-01 Fixed in 3.4.15 CWE-94

TI-2023-23888 CVE-2023-44382 · GHSA-p8q3-h652-65vx

October CMS safe mode bypass using Twig sandbox escape

MEDIUM 41

October is a Content Management System (CMS) and web platform to assist with development workflow.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00873 Published 2023-12-01 Fixed in 3.4.15 CWE-94

TI-2023-23889 CVE-2023-44383 · GHSA-rvx8-p3xp-fj3p

October CMS stored XSS by authenticated backend user with improper configuration

LOW 25

October is a Content Management System (CMS) and web platform to assist with development workflow.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0041 Published 2023-11-29 Fixed in 3.5.2 CWE-79

TI-2023-23545 CVE-2023-43876

A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an…

MEDIUM 58

A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00477 Published 2023-09-28 No fix listed CWE-79

TI-2023-19223 CVE-2023-37692 · GHSA-r47v-rxcg-p28j

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute…

MEDIUM 58

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2023-07-26 No fix listed CWE-79

TI-2022-16371 CVE-2022-35944 · GHSA-x4q7-m6fp-4v9v

October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)

LOW 36

October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01051 Published 2022-10-13 Fixed in 3.0.66, 2.2.34 CWE-94