CVE-2020-5298

In OctoberCMS (composer package october/october), CVE-2020-5298 affects versions 1.0.319 and earlier than 1.0.466 where a user with access to the ImportExportController’s import flow can be socially engineered to upload a crafted CSV, enabling a reflected XSS on the user. The issue is mitigated b...