OC
Product
october
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 15Medium 36Low 4
Watch
Add october to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-32648 In wildKEV | 9.1 | Aug 26 | Account Takeover in Octobercms Affected: >= 1.0.471, < 1.0.472; >= 1.1.1, < 1.1.5 |
| CVE-2021-3311 | 9.8 | Feb 5 | An issue was discovered in October through build 471 Affected: through 1.0.471 |
| CVE-2017-1000197 | 9.8 | Nov 17 | October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server Affected: through 1.0.412 |
| CVE-2017-1000196 | 9.8 | Nov 17 | October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server Affected: through 1.0.412 |
| CVE-2017-1000194 | 9.8 | Nov 17 | October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server Affected: through 1.0.412 |
| CVE-2023-44382 | 9.1 | Dec 1 | October CMS safe mode bypass using Twig sandbox escape Affected: >= 3.0.0, < 3.4.15 |
| CVE-2021-32649 | 8.8 | Jan 14 | Authenticated file write leads to remote code execution in october/system Affected: < 1.0.473; >= 1.1.0, < 1.1.6 |
| CVE-2021-32650 | 8.8 | Jan 14 | Arbitrary code execution in october/system Affected: < 1.0.473; >= 1.1.0, < 1.1.6 |
| CVE-2017-16941 | 8.8 | Nov 25 | October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive… Affected: through 1.0.428 |
| CVE-2017-16244 | 8.8 | Nov 1 | Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take… Affected: 1.0.426 |
| CVE-2022-24800 | 8.1 | Jul 12 | Race Condition in October CMS upload process Affected: < 1.0.476; >= 1.1.0, < 1.1.12; >= 2.0.0, < 2.2.15 |
| CVE-2018-1999009 | 8.1 | Jul 23 | October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in… Affected: All versions, or not specified |
| CVE-2023-25365 | 7.8 | Feb 8 | Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 Affected: 3.2.0 |
| CVE-2021-21265 | 7.5 | Mar 10 | October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers Affected: < 1.1.2 |
| CVE-2020-15246 | 7.5 | Nov 23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework Affected: 1.0.421 before 1.0.469 |
| CVE-2017-1000195 | 7.5 | Nov 17 | October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server Affected: through 1.0.412 |
| CVE-2021-29487 | 7.4 | Aug 26 | Authentication bypass in Octobercms Affected: >= 1.0.471, < 1.0.472; >= 1.1.1, < 1.1.5 |
| CVE-2022-35944 | 7.2 | Oct 13 | October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) Affected: >= 3.0.0, < 3.0.66; < 2.2.34 |
| CVE-2022-21705 | 7.2 | Feb 23 | Authenticated remote code execution in octobercms Affected: < 1.0.474; >= 1.1.0, < 1.1.10; >= 2.0.0, < 2.1.27 |
| CVE-2021-41126 | 7.2 | Oct 6 | Deleted Admin Can Sign In to Admin Interface Affected: >= 2.0.0, < 2.1.12 |
| CVE-2017-1000119 | 7.2 | Oct 5 | October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server Affected: 1.0.412 |
| CVE-2026-22692 | 6.8 | Apr 14 | October CMS: Twig Sandbox Bypass via Collection Methods Affected: < 3.7.13; >= 4.0.0, < 4.1.5 |
| CVE-2020-26231 | 6.7 | Nov 23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework Affected: 1.0.469; 1.1.0 |
| CVE-2026-26274 | 6.6 | Apr 21 | October: Safe Mode Bypass via Twig Database Write Operations Affected: >= 4.0.0, < 4.1.10; < 3.7.14 |
| CVE-2020-15128 | 6.3 | Jul 31 | In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to Affected: before 1.0.468 |
| CVE-2018-7198 | 6.1 | Feb 18 | October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page Affected: through 1.0.431 |
| CVE-2017-1000193 | 6.1 | Nov 17 | October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser Affected: through 1.0.412 |
| CVE-2026-24907 | 5.4 | Apr 14 | October CMS has Stored XSS via Event Log Mail Preview Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |
| CVE-2026-24906 | 5.4 | Apr 14 | October CMS has Stored XSS in its Backend Editor Markup Classes Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |
| CVE-2024-25837 | 5.4 | Aug 16 | A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload… Affected: through 1.3.8 |
| CVE-2024-25637 | 5.4 | Jun 26 | Reflected XSS via X-October-Request-Handler Header Affected: >= 3.2, < 3.5.15 |
| CVE-2023-44383 | 5.4 | Nov 29 | October CMS stored XSS by authenticated backend user with improper configuration Affected: >= 3.0.0, 3.5.2 |
| CVE-2023-43876 | 5.4 | Sep 28 | A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost… Affected: 3.4.16 |
| CVE-2023-37692 | 5.4 | Jul 26 | An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file Affected: 3.4.4 |
| CVE-2020-15249 | 5.4 | Nov 23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework Affected: 1.0.319 before 1.0.469 |
| CVE-2020-4061 | 5.4 | Jul 2 | In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack Affected: 1.0.319 before 1.0.467 |
| CVE-2018-1999008 | 5.4 | Jul 23 | October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated… Affected: before 1.0.437 |
| CVE-2017-15284 | 5.4 | Oct 12 | Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile Affected: 1.0.425 |
| CVE-2015-5613 | 5.4 | Sep 28 | Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving a file title, a… Affected: All versions, or not specified |
| CVE-2022-23655 | 5.3 | Feb 23 | Missing server signature validation in OctoberCMS Affected: >= 1.1.0, < 1.1.11; < 1.0.475 |
| CVE-2021-21264 | 5.2 | May 3 | Bypass of fix for CVE-2020-26231, Twig sandbox escape Affected: 1.0.471; 1.1.1 |
| CVE-2020-15247 | 5.2 | Nov 23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework Affected: 1.0.319 before 1.0.469 |
| CVE-2020-5299 | 5.1 | Jun 3 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV… Affected: 1.0.319 before 1.0.466 |
| CVE-2026-26067 | 4.9 | Apr 21 | October: Safe Mode Bypass via CSS Preprocessor Compilers Affected: >= 4.0.0, < 4.1.10; < 3.7.14 |
| CVE-2026-25125 | 4.9 | Apr 14 | October CMS: Environment Variable Exfiltration via INI Parser Interpolation Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |
| CVE-2024-51991 | 4.9 | May 5 | October CMS Allows Unprotected SVG Rename in Media Manager Affected: < 3.7.5 |
| CVE-2023-44381 | 4.9 | Dec 1 | October CMS safe mode bypass using Page template injection Affected: >= 3.0.0, < 3.4.15 |
| CVE-2020-5296 | 4.9 | Jun 3 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October… Affected: 1.0.319 before 1.0.466 |
| CVE-2020-5295 | 4.9 | Jun 3 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server Affected: 1.0.319 before 1.0.466 |
| CVE-2026-25133 | 4.8 | Apr 14 | October CMS has Stored XSS via SVG Filter Bypass Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |