October CMS Cross-Site Scripting Vulnerability

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October CMS versions 1.0.319 and 1.0.469 that allows a back-end user with upload file privileges to upload SVG files without any processing of the...

October CMS Security Breach

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in versions prior to October CMS v1.0.470 and prior to v1.1.1, which stems from an enabled enableSafeMode that allows specific Twig code to be writte...

October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)

Exploit Title: October CMS Build 465 - Arbitrary File Read Exploit Authenticated Date: 2020-03-31 Exploit Author: Sivanesh Ashok Vendor Homepage: https://octobercms.com/ Version: Build 465 and below Tested on: Windows 10 / XAMPP / October CMS Build 465 CVE: CVE-2020-5295 echo ''' Authenticated...

October CMS Build 465 XSS / File Read / File Deletion / CSV Injection

October CMS = Build 465 Multiple Vulnerabilities Author - Sivanesh Ashok | @sivaneshashok | stazot.com Date : 2020-03-31 Vendor : https://octobercms.com/ Version : = Build 465 Tested on : Build 465 CVE : CVE-2020-5295, CVE-2020-5296, CVE-2020-5297, CVE-2020-5298, CVE-2020-5299, CVE-2020-11083 Las...

October CMS Build 465 XSS / File Read / File Deletion / CSV Injection Vulnerabilities

October CMS builds 465 and below suffer from arbitrary file read, arbitrary file deletion, file uploading to arbitrary locations, persistent and reflective cross site scripting, and CSV injection vulnerabilities. October CMS = Build 465 Multiple Vulnerabilities Author - Sivanesh Ashok |...

PT-2020-12540 · October +1 · October Cms +1

Name of the Vulnerable Software and Affected Versions: October CMS versions 1.0.319 through 1.0.465 RainLab.Blog plugin versions prior to 1.4.1 Description: A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other...

October CMS Cross-Site Scripting Vulnerability (CNVD-2020-51531)

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A cross-site scripting vulnerability exists in October 1.0.319 and later versions fixed in version 1.0.467. The vulnerability stems from a lack of proper validation of client-side data ...

GHSA-3PC2-FM7P-Q2VG Cross-site Scripting in October

Impact Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. Patches Issue has been patched in Build 467 v1.0.467. Workarounds Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your...

CVE-2020-11094

The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...

CVE-2020-11094

The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...

Design/Logic Flaw

The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...

October CMS Command Injection Vulnerability

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A command injection vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. The vulnerability stems from a network system or product not proper...

October CMS Directory Traversal Vulnerability

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. An attacker can exploit the vulnerability to upload files to any directory o...

October CMS Arbitrary File Read Vulnerability (CNVD-2020-38885)

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. An attacker could exploit the vulnerability to read local files on the Octob...

October CMS debugbar plugin log message disclosure vulnerability

October CMS is a PHP and Laravel Web application framework based on open source content management system CMS. debugbar plugin is used in which an application debugging bar plugin . A log information disclosure vulnerability exists in the October CMS debugbar plugin prior to version 3.1.0, which ...

October CMS Arbitrary File Read Vulnerability

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. An attacker could exploit the vulnerability to delete arbitrary local files...

CVE-2020-11094

CVE-2020-11094 affects the October CMS debugbar plugin prior to v3.1.0. The issue is an information disclosure vulnerability where the plugin logs all requests, including session data, which could allow untrusted users to view sensitive information. Affected component is the debugbar feature that...

CVE-2020-11094 Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar

The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...

GHSA-C8WH-6JW4-2H79 Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar

Impact The debugbar contains a perhaps little known feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potenti...

October CMS - Upload Protection Bypass Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'October CMS Upload Protection Bypass Code Execution', 'Description' = %q This module exploits an Authenticated user with permission to upload and...