Known vulnerabilities in October CMS - page 3

Vendor: OctoberCMS
Software: October CMS
Software CPE: cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
Total vulnerabilities: 53
Public exploits: 5
Known exploited (KEV): 1

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting October CMS October CMS is affected by 53 known vulnerabilities: 5 high, 15 medium, 33 low Critical High Medium Low

Vulnerabilities (53)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU32948 - Improper Authorization
CVE-2020-15128
CWE-285 Low
No
No
1.0.468 31.07.2020 SB2020073108
#VU29541 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-4061
CWE-79 Low
No
No
1.0.467 06.07.2020 SB2020070612
#VU28770 - Improper Control of Generation of Code ('Code Injection')
CVE-2020-5299
CWE-94 Low
No
No
1.0.466 06.06.2020 SB2020060608
#VU28769 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-11083
CWE-79 Low
No
No
1.0.466 06.06.2020 SB2020060608
#VU28768 - External Control of File Name or Path
CVE-2020-5297
CWE-73 Low
No
No
1.0.466 06.06.2020 SB2020060608
#VU28767 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-5298
CWE-79 Low
No
No
1.0.466 06.06.2020 SB2020060608
#VU28766 - External Control of File Name or Path
CVE-2020-5296
CWE-73 Low
No
No
1.0.466 06.06.2020 SB2020060608
#VU28765 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2020-5295
CWE-98 Medium
Available
No
1.0.466 06.06.2020 SB2020060608
#VU27052 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-11022
CWE-79 Low
Available
No
1.0.466 21.04.2020 SB2020042126
SB2020052033
SB2020052103
and 181 more
#VU36825 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-1999008
CWE-79 Low
No
No
1.0.437 23.07.2018 SB2018072324
#VU37996 - Cross-Site Request Forgery (CSRF)
CVE-2017-16244
CWE-352 High
Available
No
- 01.11.2017 SB2017110110
#VU38072 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-15284
CWE-79 Low
Available
No
- 12.10.2017 SB2017101222
#VU38142 - Unrestricted Upload of File with Dangerous Type
CVE-2017-1000119
CWE-434 Medium
No
No
- 05.10.2017 SB2017100521


Showing elements 41 - 60 out of 53