440 matches found
October CMS Local File Inclusion
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path i...
October CMS - RainLab Blog Plugin XSS
The RainLab Blog Plugin used in October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...
GHSA-96MH-7XPR-QCGW October CMS - RainLab Blog Plugin XSS
The RainLab Blog Plugin used in October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...
October CMS File Upload Vulnerability
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
GHSA-V7CR-W5V6-6659 October CMS Local File Inclusion
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path i...
The vulnerability of the CMS system October CMS, related to improper verification of the cryptographic signature, allows a hacker to gain unauthorized access to protected information.
The vulnerability of the CMS system October CMS is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Remote Code Execution (RCE)
October CMS is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library does not properly sanitize the user input before rendering, allowing an attacker who has access to the backend to manipulate web pages via cms.safemode or cms.enableSafeMode to execute arbitrary...
Authenticated remote code execution in October CMS
Impact An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode / cms.enableSafeMode in order to execute arbitrary code. - This issue only affects admin panels that rely on safe mode and restricted permissions. - T...
October CMS Authentication Bypass (CVE-2021-32648)
An authentication bypass vulnerability exists in October CMS. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...
Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure
The coordinated cyberattacks targeting Ukrainian government websites and the deployment of a data-wiper malware called WhisperGate on select government systems are part of a broader wave of malicious activities aimed at sabotaging critical infrastructure in the country. The Secret Service of...
October CMS Improper Authentication
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request...
Ukraine government entities targeted by a destructive malware “Whispergate”
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. A malware attack was carried out on Ukraine government, non-profit, and IT entities with a wiper disguised as ransomware. The threat actor, DEV-0586 targeted government bodies that provide critical executive branch or emergen...
Remote Code Execution (RCE)
October CMS is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the input via the theme import function allowing an attacker with access to the backend to execute maliciously crafted PHP code...
Remote Code Execution (RCE)
October CMS is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of PHP code int he template markup allowing an attacker with "create, modify and delete website pages" privileges to inject maliciously crafted PHP code...
October CMS File Upload Vulnerability
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A file upload vulnerability exists in October CMS, which stems from the "Create, Modify, and Delete Site Pages" privilege of the management system, and can be exploited by an attacker t...
October CMS Code Injection Vulnerability
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. October CMS suffers from a code injection vulnerability that arises from a failure of a network system or product to properly filter specific elements of externally entered data during...
Massive Cyber Attack Knocks Down Ukrainian Government Websites
No fewer than 70 websites operated by the Ukrainian government went offline on Friday for hours in what appears to be a coordinated cyber attack amid heightened tensions with Russia. "As a result of a massive cyber attack, the websites of the Ministry of Foreign Affairs and a number of other...
GHSA-5HFJ-R725-WPC4 october/system arbitrary code execution
Impact Assuming an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates. Patches Issue has been patched in Build 473 and v1.1.6 Workarounds Apply...
Exploit for Improper Authentication in Octobercms October
CVE-2021-32648...
CVE-2021-32649
October CMS is a self-hosted content management system CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in t...