CVE-2024-51991

October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...

CVE-2024-51991

CVE-2024-51991 concerns October CMS (versions prior to 3.7.5) where an authenticated administrator with a site using the media.clean_vectors SVG sanitization can bypass protection by uploading a file with a permitted extension (e.g., .jpg/.png) and later renaming it to .svg. The issue is mitigate...

GHSA-96HH-8HX5-CPW7 October CMS Allows Unprotected SVG Rename in Media Manager

Impact This advisory affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with ...

CVE-2022-28930

ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml...

Sql injection

ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml...

CVE-2022-28930

ERP-Pro v3.7.5 contains a SQL injection vulnerability exploitable via the component /base/SysEveMenuAuthPointMapper.xml. CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector and no privileges required; confidentiality, integrity, and availability impacts are HIGH. The documents do not pr...

CVE-2022-28930

ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml...

CVE-2019-9947

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that...