OC
Product
october
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 15Medium 36Low 4
Watch
Add october to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-32649 | 8.8 | Jan 14 | Authenticated file write leads to remote code execution in october/system Affected: < 1.0.473; >= 1.1.0, < 1.1.6 |
| CVE-2021-32650 | 8.8 | Jan 14 | Arbitrary code execution in october/system Affected: < 1.0.473; >= 1.1.0, < 1.1.6 |
| CVE-2017-16941 | 8.8 | Nov 25 | October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive… Affected: through 1.0.428 |
| CVE-2017-16244 | 8.8 | Nov 1 | Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take… Affected: 1.0.426 |
| CVE-2022-24800 | 8.1 | Jul 12 | Race Condition in October CMS upload process Affected: < 1.0.476; >= 1.1.0, < 1.1.12; >= 2.0.0, < 2.2.15 |
| CVE-2018-1999009 | 8.1 | Jul 23 | October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in… Affected: All versions, or not specified |
| CVE-2023-25365 | 7.8 | Feb 8 | Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 Affected: 3.2.0 |
| CVE-2021-21265 | 7.5 | Mar 10 | October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers Affected: < 1.1.2 |
| CVE-2020-15246 | 7.5 | Nov 23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework Affected: 1.0.421 before 1.0.469 |
| CVE-2017-1000195 | 7.5 | Nov 17 | October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server Affected: through 1.0.412 |
| CVE-2021-29487 | 7.4 | Aug 26 | Authentication bypass in Octobercms Affected: >= 1.0.471, < 1.0.472; >= 1.1.1, < 1.1.5 |
| CVE-2022-35944 | 7.2 | Oct 13 | October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) Affected: >= 3.0.0, < 3.0.66; < 2.2.34 |
| CVE-2022-21705 | 7.2 | Feb 23 | Authenticated remote code execution in octobercms Affected: < 1.0.474; >= 1.1.0, < 1.1.10; >= 2.0.0, < 2.1.27 |
| CVE-2021-41126 | 7.2 | Oct 6 | Deleted Admin Can Sign In to Admin Interface Affected: >= 2.0.0, < 2.1.12 |
| CVE-2017-1000119 | 7.2 | Oct 5 | October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server Affected: 1.0.412 |
Showing 15