CVE-2026-29179 | Low | 3.3 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file oper… |
CVE-2026-27937 | Low | 3.1 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified… |
CVE-2026-26274 | Medium | 6.6 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy t… |
CVE-2026-26067 | Medium | 4.9 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in… |
CVE-2026-25133 | Medium | 4.8 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in… |
CVE-2026-25125 | Medium | 4.9 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability i… |
CVE-2026-24907 | Medium | 5.4 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in… |
CVE-2026-24906 | Medium | 5.4 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in… |
CVE-2026-22692 | Medium | 4.9 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability… |
CVE-2025-61676 | Medium | 6.1 | 2026-01-10 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified… |
CVE-2025-61674 | Medium | 6.1 | 2026-01-10 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified i… |
CVE-2024-51991 | Medium | 4.9 | 2025-05-05 | October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that… |
CVE-2024-45962 | Medium | 4.7 | 2024-10-02 | October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed throu… |
CVE-2024-25837 | Medium | 5.4 | 2024-08-16 | A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2024-25637 | Low | 3.1 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allo… |
CVE-2024-24764 | Low | 3.5 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted… |
CVE-2023-25365 | High | 7.8 | 2024-02-08 | Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 |
CVE-2023-44382 | Critical | 9.1 | 2023-12-01 | October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `… |
CVE-2023-44381 | Medium | 4.9 | 2023-12-01 | October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `… |
CVE-2023-44383 | Medium | 5.4 | 2023-11-29 | October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG file… |
CVE-2023-43876 | Medium | 5.4 | 2023-09-28 | A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload inject… |
CVE-2023-37692 | Medium | 5.4 | 2023-07-26 | An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-35944 | Medium | 6.2 | 2022-10-13 | October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely o… |
CVE-2022-24800 | High | 8.1 | 2022-07-12 | October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2… |
CVE-2022-23655 | Medium | 4.8 | 2022-02-24 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a r… |
CVE-2022-21705 | High | 7.2 | 2022-02-23 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An au… |
CVE-2021-32650 | High | 8.8 | 2022-01-14 | October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with… |
CVE-2021-32649 | High | 8.8 | 2022-01-14 | October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with… |
CVE-2021-41126 | High | 7.2 | 2021-10-06 | October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had pre… |
CVE-2021-32648 | High | 8.2 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password… |
CVE-2021-29487 | High | 7.4 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability… |
CVE-2021-21264 | Medium | 5.2 | 2021-05-03 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was di… |
CVE-2021-21265 | Medium | 6.8 | 2021-03-10 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured… |
CVE-2021-3311 | Critical | 9.8 | 2021-02-05 | An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: t… |
CVE-2020-26231 | Medium | 5.2 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discov… |
CVE-2020-15249 | Low | 2.8 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, ba… |
CVE-2020-15248 | Medium | 4.0 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, ba… |
CVE-2020-15247 | Medium | 5.2 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an… |
CVE-2020-15246 | High | 7.5 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an… |
CVE-2020-15128 | Medium | 6.1 | 2020-07-31 | In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of… |
CVE-2020-11083 | Low | 3.5 | 2020-07-14 | In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS… |
CVE-2020-4061 | Low | 3.7 | 2020-07-02 | In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a success… |
CVE-2020-11094 | Medium | 6.1 | 2020-06-04 | The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request includin… |
CVE-2020-5299 | Medium | 4.0 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually… |
CVE-2020-5298 | Medium | 4.0 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `Impo… |
CVE-2020-5297 | Low | 3.4 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp… |
CVE-2020-5296 | Medium | 6.2 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local… |
CVE-2020-5295 | Medium | 4.8 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an… |
CVE-2018-1999009 | High | 8.1 | 2018-07-23 | October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) tha… |
CVE-2018-1999008 | Medium | 5.4 | 2018-07-23 | October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result… |
CVE-2018-7198 | Medium | 6.1 | 2018-02-18 | October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page. |
CVE-2017-16941 | High | 8.8 | 2017-11-25 | October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a… |
CVE-2017-1000197 | Critical | 9.8 | 2017-11-17 | October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server. |
CVE-2017-1000196 | Critical | 9.8 | 2017-11-17 | October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on th… |
CVE-2017-1000195 | High | 7.5 | 2017-11-17 | October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the… |
CVE-2017-1000194 | Critical | 9.8 | 2017-11-17 | October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applicat… |
CVE-2017-1000193 | Medium | 6.1 | 2017-11-17 | October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser. |
CVE-2017-16244 | High | 8.8 | 2017-11-01 | Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker t… |
CVE-2017-15284 | Medium | 5.4 | 2017-10-12 | Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avat… |
CVE-2017-1000119 | High | 7.2 | 2017-10-05 | October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the… |
CVE-2015-5613 | Medium | 5.4 | 2017-09-28 | Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involv… |
CVE-2015-5612 | | | 2015-09-04 | Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption ta… |