Skip to contentOctobercms October vulnerabilities
- octobercms octoberOctober CMS: PHP Object Injection via Backend Widget Session StorageCVE-2026-49400Fix available3.3 Low
- octobercms octoberOctober: Editor Sub-Permission Bypass for Asset and Blueprint File OperationsCVE-2026-29179Fix available3.3 Low
- octobercms octoberOctober: Reflected XSS via DataTable Form WidgetCVE-2026-27937Fix available3.1 Low
- octobercms octoberOctober: Safe Mode Bypass via Twig Database Write OperationsCVE-2026-26274Fix available6.6 Medium
- octobercms octoberOctober: Safe Mode Bypass via CSS Preprocessor CompilersCVE-2026-26067Fix available4.9 Medium
- octobercms octoberOctober CMS has Stored XSS via SVG Filter BypassCVE-2026-25133Fix available4.8 Medium
- octobercms octoberOctober CMS: Environment Variable Exfiltration via INI Parser InterpolationCVE-2026-25125Fix available4.9 Medium
- octobercms octoberOctober CMS has Stored XSS via Event Log Mail PreviewCVE-2026-24907Fix available5.1 Medium
- octobercms octoberOctober CMS has Stored XSS in its Backend Editor Markup ClassesCVE-2026-24906Fix available5.1 Medium
- octobercms octoberOctober CMS: Twig Sandbox Bypass via Collection MethodsCVE-2026-22692Public exploitFix available4.9 Medium
- octobercms octoberOctober CMS Vulnerable to Stored XSS via Branding StylesCVE-2025-61676Fix available6.1 Medium
- octobercms octoberOctober CMS Vulnerable to Stored XSS via Editor and Branding StylesCVE-2025-61674Fix available6.1 Medium
- octobercms octoberOctober CMS Allows Unprotected SVG Rename in Media ManagerCVE-2024-51991Fix available1.1 Low
- octobercms octoberOctober allows an admin account to upload PDF containing malicious JavaScriptCVE-2024-459624.7 Medium
- octobercms octoberA stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower...CVE-2024-258375.4 Medium
- octobercms octoberReflected XSS via X-October-Request-Handler HeaderCVE-2024-25637Fix available3.1 Low
- octobercms octoberOctober Open Redirect for Administrator AccountsCVE-2024-24764Fix available3.5 Low
- octobercms octoberOctober CMS Cross-site Scripting vulnerabilityCVE-2023-253657.8 High
- octobercms octoberOctober CMS safe mode bypass using Twig sandbox escapeCVE-2023-44382Fix available9.1 Critical
- octobercms octoberOctober CMS safe mode bypass using Page template injectionCVE-2023-44381Fix available4.9 Medium
- octobercms octoberOctober CMS stored XSS by authenticated backend user with improper configurationCVE-2023-44383Fix available5.4 Medium
- octobercms octoberWithdrawn Advisory: October Cross-site Scripting vulnerabilityCVE-2023-43876Public exploit5.4 Medium
- octobercms octoberStored Cross-Site Scripting October CMSCVE-2023-376925.4 Medium
- octobercms octoberOctober CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)CVE-2022-35944Fix available6.2 Medium
- octobercms octoberRace Condition in October CMS upload processCVE-2022-24800Fix available8.1 High
- octobercms octoberMissing server signature validation in OctoberCMSCVE-2022-23655Fix available4.8 Medium
- octobercms octoberAuthenticated remote code execution in octobercmsCVE-2022-21705Fix available7.2 High
- octobercms octoberAuthenticated file write leads to remote code execution in october/systemCVE-2021-32649Fix available8.8 High
- octobercms octoberArbitrary code execution in october/systemCVE-2021-32650Fix available8.8 High
- octobercms octoberDeleted Admin Can Sign In to Admin InterfaceCVE-2021-41126Fix available7.2 High
- octobercms octoberAuthentication bypass in OctobercmsCVE-2021-29487Fix available7.4 High
- october cms cms, octobercms october +1 moreAccount Takeover in OctobercmsCVE-2021-32648In KEVPublic exploitFix availableEPSS 91.2%8.2 High
- octobercms octoberBypass of fix for CVE-2020-26231, Twig sandbox escapeCVE-2021-21264Fix available5.2 Medium
- octobercms octoberOctober CMS vulnerable to Potential Host Header Poisoning on misconfigured serversCVE-2021-21265Fix available6.8 Medium
- octobercms octoberOctober CMS Session ID not invalidated after logoutCVE-2021-3311Fix available9.8 Critical
- octobercms octoberBypass of fix for CVE-2020-15247, Twig sandbox escapeCVE-2020-26231Fix available5.2 Medium
- octobercms octoberStored XSS by authenticated backend user with access to upload filesCVE-2020-15249Fix available2.8 Low
- octobercms octoberPrivilege escalation by backend users assigned to the default "Publisher" system roleCVE-2020-15248Fix available4.0 Medium
- octobercms octoberTwig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.CVE-2020-15247Fix available5.2 Medium
- octobercms octoberLocal File Inclusion by unauthenticated usersCVE-2020-15246Fix available7.5 High
- octobercms octoberReliance on Cookies without validation in OctoberCMSCVE-2020-15128Fix available6.1 Medium
- october cms octoberStored XSS in OctoberCVE-2020-11083Fix available3.5 Low
- october cms octoberCross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websitesCVE-2020-4061Fix available3.7 Low
- octobercms octoberPotential CSV Injection vector in OctoberCMSCVE-2020-5299Fix available4.0 Medium
- octobercms octoberArbitrary File Deletion vulnerability in OctoberCMSCVE-2020-5296Fix available6.2 Medium
- octobercms octoberUpload whitelisted files to any directory in OctoberCMSCVE-2020-5297Fix available3.4 Low
- octobercms octoberReflected XSS when importing CSV in OctoberCMSCVE-2020-5298Fix available4.0 Medium
- octobercms octoberLocal File read vulnerability in OctoberCMSCVE-2020-5295Public exploitFix available4.8 Medium
- octobercms octoberOctober CMS Local File InclusionCVE-2018-1999009Fix available8.1 High
- octobercms octoberOctober CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the...CVE-2018-19990085.4 Medium
- Show moreLoading…