Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

october/backend

7 known vulnerabilities (4 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 4 medium, 3 low
Registry
Packagist

Advisories 7

  • CVE-2021-21265Medium 6.8

    October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers

    Affected: fixed in 1.1.2.

  • Stored XSS by authenticated backend user with access to upload files

    Affected: from 1.0.319, fixed in 1.0.469.

  • CVE-2020-15248Medium 4.0

    Privilege escalation by backend users assigned to the default "Publisher" system role

    Affected: from 1.0.319, fixed in 1.0.470.

  • Stored XSS in October

    Affected: from 1.0.319, fixed in 1.0.466.

  • Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites

    Affected: from 1.0.319, fixed in 1.0.467.

  • CVE-2020-5299Medium 4.0

    Potential CSV Injection vector in OctoberCMS

    Affected: from 1.0.319, fixed in 1.0.466.

  • CVE-2020-5298Medium 4.0

    Reflected XSS when importing CSV in OctoberCMS

    Affected: from 1.0.319, fixed in 1.0.466.