Vulnerabilities > Octobercms > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-06-03 | CVE-2020-5297 | External Control of File Name or Path vulnerability in Octobercms October In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. | 4.0 |
| 2020-06-03 | CVE-2020-5296 | External Control of File Name or Path vulnerability in Octobercms October In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. | 4.0 |
| 2020-06-03 | CVE-2020-5295 | PHP Remote File Inclusion vulnerability in Octobercms October In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. | 4.0 |
| 2018-07-23 | CVE-2018-1999009 | Information Exposure vulnerability in Octobercms October October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. | 6.8 |
| 2018-02-18 | CVE-2018-7198 | Cross-site Scripting vulnerability in Octobercms October October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page. | 4.3 |
| 2017-11-17 | CVE-2017-1000195 | Deserialization of Untrusted Data vulnerability in Octobercms October October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server. | 6.4 |
| 2017-11-17 | CVE-2017-1000193 | Cross-site Scripting vulnerability in Octobercms October October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser. | 4.3 |
| 2017-11-01 | CVE-2017-16244 | Cross-Site Request Forgery (CSRF) vulnerability in Octobercms October 1.0.426 Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. | 6.8 |
| 2017-10-05 | CVE-2017-1000119 | Unrestricted Upload of File with Dangerous Type vulnerability in Octobercms October 1.0.412 October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server. | 6.5 |
| 2015-09-04 | CVE-2015-5612 | Cross-site Scripting vulnerability in Octobercms October Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image. | 4.3 |