Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

october/cms

8 known vulnerabilities (1 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 1 high, 5 medium, 1 low
Registry
Packagist

Advisories 8

  • CVE-2021-21264Medium 5.2

    Bypass of fix for CVE-2020-26231, Twig sandbox escape

    Affected: from 1.0.471, fixed in 1.0.472; from 1.1.1, fixed in 1.1.2.

  • CVE-2020-26231Medium 5.2

    Bypass of fix for CVE-2020-15247, Twig sandbox escape

    Affected: from 1.0.469, fixed in 1.0.470.

  • CVE-2020-15247Medium 5.2

    Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

    Affected: from 1.0.319, fixed in 1.0.469.

  • Local File Inclusion by unauthenticated users

    Affected: from 1.0.421, fixed in 1.0.469.

  • CVE-2020-5296Medium 6.2

    Arbitrary File Deletion vulnerability in OctoberCMS

    Affected: from 1.0.319, fixed in 1.0.466.

  • Upload whitelisted files to any directory in OctoberCMS

    Affected: from 1.0.319, fixed in 1.0.466.

  • CVE-2020-5295Medium 4.8

    Local File read vulnerability in OctoberCMS

    Affected: from 1.0.319, fixed in 1.0.466.

  • October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other…

    Affected: through 1.0.412.