Octobercms vulnerabilities
41 CVEs and advisories name Octobercms as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-26231Bypass of fix for CVE-2020-15247, Twig sandbox escape
- CVE-2020-15249Stored XSS by authenticated backend user with access to upload files
- CVE-2020-15248Privilege escalation by backend users assigned to the default "Publisher" system role
- CVE-2020-15247Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
- CVE-2020-15246Local File Inclusion by unauthenticated users
- CVE-2020-15128Reliance on Cookies without validation in OctoberCMS
- CVE-2020-5299Potential CSV Injection vector in OctoberCMS
- CVE-2020-5296Arbitrary File Deletion vulnerability in OctoberCMS
- CVE-2020-5297Upload whitelisted files to any directory in OctoberCMS
- CVE-2020-5298Reflected XSS when importing CSV in OctoberCMS
- CVE-2020-5295Local File read vulnerability in OctoberCMS