OctoberCMS October

October CMS has Stored XSS via Event Log Mail Preview

Missing server signature validation in OctoberCMS

Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

Bypass of fix for CVE-2020-26231, Twig sandbox escape

Potential CSV Injection vector in OctoberCMS

Local File read vulnerability in OctoberCMS

October CMS safe mode bypass using Page template injection

October CMS Allows Unprotected SVG Rename in Media Manager

October CMS: Environment Variable Exfiltration via INI Parser Interpolation

Stored XSS in October

Reflected XSS when importing CSV in OctoberCMS

October Open Redirect for Administrator Accounts

October CMS has Stored XSS via SVG Filter Bypass

October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.

Privilege escalation by backend users assigned to the default "Publisher" system role

Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.

Upload whitelisted files to any directory in OctoberCMS