Octobercms vulnerabilities

Products

• October 62

Newest

• octobercms october October CMS: PHP Object Injection via Backend Widget Session Storage CVE-2026-49400 Fix available 3.3 LowSeptember 14, 2026
• android system October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls CVE-2026-46696 Fix available 3.3 LowSeptember 14, 2026
• octobercms october October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations CVE-2026-29179 Fix available 3.3 LowApril 21, 2026
• octobercms october October: Reflected XSS via DataTable Form Widget CVE-2026-27937 Fix available 3.1 LowApril 21, 2026
• octobercms october October: Safe Mode Bypass via Twig Database Write Operations CVE-2026-26274 Fix available 6.6 MediumApril 21, 2026
• octobercms october October: Safe Mode Bypass via CSS Preprocessor Compilers CVE-2026-26067 Fix available 4.9 MediumApril 21, 2026
• octobercms october October CMS has Stored XSS via SVG Filter Bypass CVE-2026-25133 Fix available 4.8 MediumApril 14, 2026
• octobercms october October CMS: Environment Variable Exfiltration via INI Parser Interpolation CVE-2026-25125 Fix available 4.9 MediumApril 14, 2026
• octobercms october October CMS has Stored XSS via Event Log Mail Preview CVE-2026-24907 Fix available 5.1 MediumApril 14, 2026
• octobercms october October CMS has Stored XSS in its Backend Editor Markup Classes CVE-2026-24906 Fix available 5.1 MediumApril 14, 2026
• octobercms october October CMS: Twig Sandbox Bypass via Collection Methods CVE-2026-22692 Public exploitFix available 4.9 MediumApril 14, 2026
• octobercms october October CMS Vulnerable to Stored XSS via Branding Styles CVE-2025-61676 Fix available 6.1 MediumJanuary 9, 2026
• octobercms october October CMS Vulnerable to Stored XSS via Editor and Branding Styles CVE-2025-61674 Fix available 6.1 MediumJanuary 9, 2026
• octobercms october October CMS Allows Unprotected SVG Rename in Media Manager CVE-2024-51991 Fix available 1.1 LowMay 5, 2025
• octobercms october October allows an admin account to upload PDF containing malicious JavaScript CVE-2024-45962 4.7 MediumOctober 2, 2024
• octobercms october A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower... CVE-2024-25837 5.4 MediumAugust 16, 2024
• octobercms october Reflected XSS via X-October-Request-Handler Header CVE-2024-25637 Fix available 3.1 LowJune 26, 2024
• octobercms october October Open Redirect for Administrator Accounts CVE-2024-24764 Fix available 3.5 LowJune 26, 2024
• octobercms october October CMS Cross-site Scripting vulnerability CVE-2023-25365 7.8 HighFebruary 8, 2024
• octobercms october October CMS safe mode bypass using Twig sandbox escape CVE-2023-44382 Fix available 9.1 CriticalNovember 29, 2023
• octobercms october October CMS safe mode bypass using Page template injection CVE-2023-44381 Fix available 4.9 MediumNovember 29, 2023
• octobercms october October CMS stored XSS by authenticated backend user with improper configuration CVE-2023-44383 Fix available 5.4 MediumNovember 29, 2023
• octobercms october Withdrawn Advisory: October Cross-site Scripting vulnerability CVE-2023-43876 Public exploit 5.4 MediumSeptember 28, 2023
• octobercms october Stored Cross-Site Scripting October CMS CVE-2023-37692 5.4 MediumJuly 26, 2023
• octobercms october October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) CVE-2022-35944 Fix available 6.2 MediumOctober 13, 2022
• octobercms october Race Condition in October CMS upload process CVE-2022-24800 Fix available 8.1 HighJuly 12, 2022
• octobercms october Missing server signature validation in OctoberCMS CVE-2022-23655 Fix available 4.8 MediumFebruary 23, 2022
• octobercms october Authenticated remote code execution in octobercms CVE-2022-21705 Fix available 7.2 HighFebruary 23, 2022
• octobercms october Authenticated file write leads to remote code execution in october/system CVE-2021-32649 Fix available 8.8 HighJanuary 14, 2022
• octobercms october Arbitrary code execution in october/system CVE-2021-32650 Fix available 8.8 HighJanuary 14, 2022
• octobercms october Deleted Admin Can Sign In to Admin Interface CVE-2021-41126 Fix available 7.2 HighOctober 6, 2021
• octobercms october Authentication bypass in Octobercms CVE-2021-29487 Fix available 7.4 HighAugust 26, 2021
• october cms cms, octobercms october +1 more Account Takeover in Octobercms CVE-2021-32648 In KEVPublic exploitFix available EPSS 91.2% 8.2 HighAugust 26, 2021
• octobercms october Bypass of fix for CVE-2020-26231, Twig sandbox escape CVE-2021-21264 Fix available 5.2 MediumMay 3, 2021
• octobercms october October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers CVE-2021-21265 Fix available 6.8 MediumMarch 10, 2021
• octobercms october October CMS Session ID not invalidated after logout CVE-2021-3311 Fix available 9.8 CriticalFebruary 5, 2021
• octobercms october Bypass of fix for CVE-2020-15247, Twig sandbox escape CVE-2020-26231 Fix available 5.2 MediumNovember 23, 2020
• octobercms october Stored XSS by authenticated backend user with access to upload files CVE-2020-15249 Fix available 2.8 LowNovember 23, 2020
• octobercms october Privilege escalation by backend users assigned to the default "Publisher" system role CVE-2020-15248 Fix available 4.0 MediumNovember 23, 2020
• octobercms october Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. CVE-2020-15247 Fix available 5.2 MediumNovember 23, 2020
• octobercms october Local File Inclusion by unauthenticated users CVE-2020-15246 Fix available 7.5 HighNovember 23, 2020
• octobercms october Reliance on Cookies without validation in OctoberCMS CVE-2020-15128 Fix available 6.1 MediumJuly 31, 2020
• october cms october Stored XSS in October CVE-2020-11083 Fix available 3.5 LowJuly 14, 2020
• october cms october Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites CVE-2020-4061 Fix available 3.7 LowJuly 2, 2020
• octobercms debugbar, rainlab debugbar-plugin +1 more Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar CVE-2020-11094 Fix available 6.1 MediumJune 3, 2020
• octobercms october Potential CSV Injection vector in OctoberCMS CVE-2020-5299 Fix available 4.0 MediumJune 3, 2020
• octobercms october Arbitrary File Deletion vulnerability in OctoberCMS CVE-2020-5296 Fix available 6.2 MediumJune 3, 2020
• octobercms october Upload whitelisted files to any directory in OctoberCMS CVE-2020-5297 Fix available 3.4 LowJune 3, 2020
• octobercms october Reflected XSS when importing CSV in OctoberCMS CVE-2020-5298 Fix available 4.0 MediumJune 3, 2020
• octobercms october Local File read vulnerability in OctoberCMS CVE-2020-5295 Public exploitFix available 4.8 MediumJune 3, 2020
• Show olderLoading…