Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

october/rain

6 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 4 medium
Registry
Packagist

Advisories 6

  • CVE-2026-25133Medium 4.8

    October CMS has Stored XSS via SVG Filter Bypass

    Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.7.14.

  • CVE-2026-25125Medium 4.9

    October CMS: Environment Variable Exfiltration via INI Parser Interpolation

    Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.7.14.

  • CVE-2026-22692Medium 4.9

    October CMS: Twig Sandbox Bypass via Collection Methods

    Affected: from 4.0.0, fixed in 4.1.5; fixed in 3.7.13.

  • An issue was discovered in October through build 471.

    Affected: fixed in 1.0.472; from 1.1.0, fixed in 1.1.2.

  • CVE-2020-15128Medium 6.1

    Reliance on Cookies without validation in OctoberCMS

    Affected: from 1.0.319, fixed in 1.0.468.

  • Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing…

    Affected: fixed in 1.0.426.