Skip to content
OpenAdvisories

Vendor

October CMS

43 known vulnerabilities.

Products

october 42 system 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-22692 Public exploit

    October CMS: Twig Sandbox Bypass via Collection Methods

    October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper wer…

    October CMS october october/rain Packagist
  • High 8.2
    CVE-2021-32648 Exploited Public exploit Scanner template EPSS 91%

    Account Takeover in Octobercms

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been pat…

    October CMS october october/system Packagist
    KEV Jan 18, 2022
  • Medium 4.8
    CVE-2020-5295 Public exploit

    Local File read vulnerability in OctoberCMS

    In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the…

    October CMS october october/cms Packagist