Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 25
Reset filtersOctober CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
October CMS: Reflected XSS via DataTable Form Widget
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
October CMS has Stored XSS in Event Log Mail Preview
October CMS has Stored XSS in Backend Editor Markup Classes
October CMS Vulnerable to Stored XSS via Branding Styles
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
October CMS Allows Unprotected SVG Rename in Media Manager
October System module has an Open Redirect for Administrator Accounts
October System module has a Reflected XSS via X-October-Request-Handler Header
October CMS stored XSS by authenticated backend user with improper configuration
October CMS safe mode bypass using Twig sandbox escape
October CMS safe mode bypass using Page template injection
October CMS Safe Mode bypass leads to authenticated Remote Code Execution
October CMS upload process vulnerable to RCE via Race Condition
Missing server signature validation in OctoberCMS
Authenticated remote code execution in October CMS
october/system arbitrary code execution
October/System authenticated file write leads to remote code execution
Deleted Admin Can Sign In to Admin Interface
October CMS auth bypass and account takeover
Account Takeover in Octobercms
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.