CVE-2020-15249

creationtimestamp| type| source ---|---|--- 2020-11-23 22:46:03+00:00| seen| https://t.me/cibsecurity/16734...

CVE-2020-15249

CVE-2020-15249 applies to October CMS: backend file upload allowed SVGs without sanitization in versions before 1.0.469 (and 1.0.x), enabling potential stored XSS via uploaded SVG content. The issue’s root cause is lack of SVG sanitization in the Media upload feature; the backend displays SVGs as...