OctoberCMS October any version

An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.

October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server.

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.

October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server.

Account Takeover in Octobercms

October CMS safe mode bypass using Twig sandbox escape

October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.

Authenticated file write leads to remote code execution in october/system

Authenticated remote code execution in octobercms

October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.

Race Condition in October CMS upload process

October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers

Local File Inclusion by unauthenticated users

October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.

Authentication bypass in Octobercms

Deleted Admin Can Sign In to Admin Interface

October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)

October CMS: Twig Sandbox Bypass via Collection Methods

Reliance on Cookies without validation in OctoberCMS

Arbitrary File Deletion vulnerability in OctoberCMS

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.

October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.

October CMS Vulnerable to Stored XSS via Editor and Branding Styles

October CMS Vulnerable to Stored XSS via Branding Styles

Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving a file title, a different vulnerability than CVE-2015-5612.

Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites

October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.

Stored XSS by authenticated backend user with access to upload files

October CMS stored XSS by authenticated backend user with improper configuration

Reflected XSS via X-October-Request-Handler Header

October CMS has Stored XSS in its Backend Editor Markup Classes

A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.

October CMS has Stored XSS via Event Log Mail Preview

Missing server signature validation in OctoberCMS

Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

Bypass of fix for CVE-2020-26231, Twig sandbox escape

Potential CSV Injection vector in OctoberCMS

Local File read vulnerability in OctoberCMS

October CMS safe mode bypass using Page template injection

October CMS Allows Unprotected SVG Rename in Media Manager