GHSA-R47V-RXCG-P28J Stored Cross-Site Scripting October CMS

An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users...

Stored Cross-Site Scripting October CMS

An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

Design/Logic Flaw

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

PT-2023-26079 · Unknown · October Cms

Name of the Vulnerable Software and Affected Versions: October CMS version 3.4.4 Description: The issue allows attackers to execute arbitrary code via a crafted file, specifically an svg file, which can be uploaded to the system. This can be done in the context of a browser and requires the...

CVE-2023-37692

October CMS v3.4.4 is affected by an arbitrary file upload vulnerability that allows an authenticated attacker to upload a crafted file (notably an SVG) to execute arbitrary code in the browser context. The issue appears to stem from inadequate validation/sanitization in the file upload handling,...

October CMS 1.0.471 / 1.1.1 < 1.1.5 Improper Authentication

October CMS is a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. No source data...

CVE-2022-35944

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

Design/Logic Flaw

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

October CMS Safe Mode bypass leads to authenticated Remote Code Execution

Impact This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode cms.safemode...

CVE-2022-35944 October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

CVE-2022-35944 October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

October CMS 代码注入漏洞

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A code injection vulnerability exists in October CMS versions 2.2.33 and 3.0.65, which can be exploited by an attacker to bypass the safe mode cms.safemode restriction and introduce new...

CVE-2022-35944 October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

CVE-2022-35944

CVE-2022-35944 affects October CMS (Laravel-based). The flaw allows bypass of the Safe Mode cms.safe_mode when an attacker with admin Editor access crafts a request to inject PHP code into a CMS template. Patches exist in v2.2.34 and v3.0.66; no public exploit details are provided in the connecte...

The vulnerability of the fromData method implementation in the October CMS system allows a perpetrator to execute arbitrary code.

The vulnerability of the fromData method implementation in October CMS is related to the use of a shared resource with incorrect synchronization. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...