Login Request a demo
OC
Vendor
octobercms
4 products with CVEs on record
65
CVEs
1
On KEV
0
New 30D
Products
OC
october
octobercms
9.8
62 CVEs1 on KEV0 new
DE
Debugbar
Octobercms
9.8
1 CVEs0 on KEV0 new
OC
OctoberCMS
Octobercms
7.3
1 CVEs0 on KEV0 new
SY
system
octobercms
3.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-100909
OC
OctoberCMS
Octobercms
7.3
0%
Sep 28OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery
CVE-2026-49400
OC
october
octobercms
3.3
0%
Sep 14October CMS: PHP Object Injection via Backend Widget Session Storage
CVE-2026-46696
SY
system
octobercms
3.3
0%
Sep 14October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
CVE-2026-29179
OC
october
octobercms
3.3
0%
Apr 21October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
CVE-2026-27937
OC
october
octobercms
3.1
0%
Apr 21October: Reflected XSS via DataTable Form Widget
CVE-2026-26274
OC
october
octobercms
6.6
0%
Apr 21October: Safe Mode Bypass via Twig Database Write Operations
CVE-2026-26067
OC
october
octobercms
4.9
0%
Apr 21October: Safe Mode Bypass via CSS Preprocessor Compilers
CVE-2026-25133
OC
october
octobercms
4.8
0%
Apr 14October CMS has Stored XSS via SVG Filter Bypass
CVE-2026-25125
OC
october
octobercms
4.9
0%
Apr 14October CMS: Environment Variable Exfiltration via INI Parser Interpolation
CVE-2026-24907
OC
october
octobercms
5.4
0%
Apr 14October CMS has Stored XSS via Event Log Mail Preview
CVE-2026-24906
OC
october
octobercms
5.4
0%
Apr 14October CMS has Stored XSS in its Backend Editor Markup Classes
CVE-2026-22692
OC
october
octobercms
6.8
0%
Apr 14October CMS: Twig Sandbox Bypass via Collection Methods
CVE-2025-61674
OC
october
octobercms
4.8
0%
Jan 10October CMS Vulnerable to Stored XSS via Editor and Branding Styles
CVE-2025-61676
OC
october
octobercms
4.8
0%
Jan 10October CMS Vulnerable to Stored XSS via Branding Styles
CVE-2024-51991
OC
october
octobercms
4.9
0%
May 5October CMS Allows Unprotected SVG Rename in Media Manager
CVE-2024-45962
OC
October
Octobercms
4.7
1%
Oct 2October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system
CVE-2024-25837
OC
October
Octobercms
5.4
0%
Aug 16A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
CVE-2024-25637
OC
october
octobercms
5.4
0%
Jun 26Reflected XSS via X-October-Request-Handler Header
CVE-2024-24764
OC
october
octobercms
4.8
0%
Jun 26October Open Redirect for Administrator Accounts
CVE-2023-25365
OC
October
Octobercms
7.8
0%
Feb 8Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3
CVE-2023-44381
OC
october
octobercms
4.9
1%
Dec 1October CMS safe mode bypass using Page template injection
CVE-2023-44382
OC
october
octobercms
9.1
1%
Dec 1October CMS safe mode bypass using Twig sandbox escape
CVE-2023-44383
OC
october
octobercms
5.4
0%
Nov 29October CMS stored XSS by authenticated backend user with improper configuration
CVE-2023-43876
OC
October
Octobercms
5.4
0%
Sep 28A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost…
CVE-2023-37692
OC
October
Octobercms
5.4
1%
Jul 26An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file
CVE-2022-35944
OC
october
octobercms
7.2
1%
Oct 13October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)
CVE-2022-24800
OC
october
octobercms
8.1
1%
Jul 12Race Condition in October CMS upload process
CVE-2022-23655
OC
october
octobercms
5.3
1%
Feb 23Missing server signature validation in OctoberCMS
CVE-2022-21705
OC
october
octobercms
7.2
9%
Feb 23Authenticated remote code execution in octobercms
CVE-2021-32649
OC
october
octobercms
8.8
1%
Jan 14Authenticated file write leads to remote code execution in october/system
CVE-2021-32650
OC
october
octobercms
8.8
2%
Jan 14Arbitrary code execution in october/system
CVE-2021-41126
OC
october
octobercms
7.2
1%
Oct 6Deleted Admin Can Sign In to Admin Interface
CVE-2021-29487
OC
october
octobercms
7.4
1%
Aug 26Authentication bypass in Octobercms
CVE-2021-32648
In wildKEV
OC
october
octobercms
9.1
90%
Aug 26Account Takeover in Octobercms
CVE-2021-21264
OC
october
octobercms
5.2
0%
May 3Bypass of fix for CVE-2020-26231, Twig sandbox escape
CVE-2021-21265
OC
october
octobercms
7.5
2%
Mar 10October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
CVE-2021-3311
OC
October
Octobercms
9.8
3%
Feb 5An issue was discovered in October through build 471
CVE-2020-26231
OC
October
Octobercms
6.7
0%
Nov 23October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework
CVE-2020-15249
OC
October
Octobercms
5.4
0%
Nov 23October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework
CVE-2020-15248
OC
October
Octobercms
4.2
0%
Nov 23October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework
CVE-2020-15247
OC
October
Octobercms
5.2
0%
Nov 23October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework
CVE-2020-15246
OC
October
Octobercms
7.5
2%
Nov 23October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework
CVE-2020-15128
OC
October
Octobercms
6.3
1%
Jul 31In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to
CVE-2020-11083
OC
October
Octobercms
4.8
1%
Jul 14In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against…
CVE-2020-4061
OC
October
Octobercms
5.4
1%
Jul 2In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack
CVE-2020-11094
DE
Debugbar
Octobercms
9.8
1%
Jun 4The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data)…
CVE-2020-5299
OC
October
Octobercms
5.1
1%
Jun 3In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV…
CVE-2020-5298
OC
October
Octobercms
4.8
1%
Jun 3In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController`…
CVE-2020-5297
OC
October
Octobercms
2.7
1%
Jun 3In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif,…
CVE-2020-5296
OC
October
Octobercms
4.9
1%
Jun 3In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October…
CVE-2020-5295
OC
October
Octobercms
4.9
7%
Jun 3In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server
CVE-2018-1999009
OC
October
Octobercms
8.1
2%
Jul 23October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in…
CVE-2018-1999008
OC
October
Octobercms
5.4
1%
Jul 23October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated…
CVE-2018-7198
OC
October
Octobercms
6.1
2%
Feb 18October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page
CVE-2017-16941
OC
October
Octobercms
8.8
2%
Nov 25October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive…
CVE-2017-1000197
OC
October
Octobercms
9.8
1%
Nov 17October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server
CVE-2017-1000196
OC
October
Octobercms
9.8
2%
Nov 17October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server
CVE-2017-1000195
OC
October
Octobercms
7.5
2%
Nov 17October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server
CVE-2017-1000194
OC
October
Octobercms
9.8
1%
Nov 17October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server
CVE-2017-1000193
OC
October
Octobercms
6.1
1%
Nov 17October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser