Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

october Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Published	Severity

`CVE-2026-49400`October CMS: PHP Object Injection via Backend Widget Session Storage	Exploitation statusNot known exploited	FixYes	Published09/14/2026	SeverityLow
`CVE-2026-29179`October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations	Exploitation statusNot known exploited	FixYes	Published04/21/2026	SeverityLow
`CVE-2026-27937`October: Reflected XSS via DataTable Form Widget	Exploitation statusNot known exploited	FixYes	Published04/21/2026	SeverityLow
`CVE-2026-26274`October: Safe Mode Bypass via Twig Database Write Operations	Exploitation statusNot known exploited	FixYes	Published04/21/2026	SeverityMedium
`CVE-2026-26067`October: Safe Mode Bypass via CSS Preprocessor Compilers	Exploitation statusNot known exploited	FixYes	Published04/21/2026	SeverityMedium
`CVE-2026-25133`October CMS has Stored XSS via SVG Filter Bypass	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityMedium
`CVE-2026-25125`October CMS: Environment Variable Exfiltration via INI Parser Interpolation	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityMedium
`CVE-2026-24907`October CMS has Stored XSS via Event Log Mail Preview	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityMedium
`CVE-2026-24906`October CMS has Stored XSS in its Backend Editor Markup Classes	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityMedium
`CVE-2026-22692`October CMS: Twig Sandbox Bypass via Collection Methods	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityMedium
`CVE-2025-61674`October CMS Vulnerable to Stored XSS via Editor and Branding Styles	Exploitation statusNot known exploited	FixYes	Published01/10/2026	SeverityMedium
`CVE-2025-61676`October CMS Vulnerable to Stored XSS via Branding Styles	Exploitation statusNot known exploited	FixYes	Published01/10/2026	SeverityMedium
`CVE-2024-51991`October CMS Allows Unprotected SVG Rename in Media Manager	Exploitation statusNot known exploited	FixYes	Published05/05/2025	SeverityLow
`CVE-2024-45962`	Exploitation statusPublic exploit	FixNot confirmed	Published10/02/2024	SeverityMedium
`CVE-2024-25837`	Exploitation statusNot known exploited	FixNot confirmed	Published08/16/2024	SeverityMedium
`CVE-2024-25637`Reflected XSS via X-October-Request-Handler Header	Exploitation statusNot known exploited	FixYes	Published06/26/2024	SeverityLow
`CVE-2024-24764`October Open Redirect for Administrator Accounts	Exploitation statusNot known exploited	FixYes	Published06/26/2024	SeverityLow
`CVE-2023-25365`	Exploitation statusNot known exploited	FixNot confirmed	Published02/08/2024	SeverityHigh
`CVE-2023-44381`October CMS safe mode bypass using Page template injection	Exploitation statusNot confirmed	FixYes	Published12/01/2023	SeverityMedium
`CVE-2023-44382`October CMS safe mode bypass using Twig sandbox escape	Exploitation statusNot confirmed	FixYes	Published12/01/2023	SeverityCritical
`CVE-2023-44383`October CMS stored XSS by authenticated backend user with improper configuration	Exploitation statusNot known exploited	FixYes	Published11/29/2023	SeverityMedium
`CVE-2023-43876`	Exploitation statusPublic exploit	FixNot confirmed	Published09/28/2023	SeverityUnknown
`CVE-2023-37692`	Exploitation statusPublic exploit	FixNot confirmed	Published07/26/2023	SeverityUnknown
`CVE-2022-35944`October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)	Exploitation statusNot known exploited	FixYes	Published10/13/2022	SeverityMedium
`CVE-2022-24800`Race Condition in October CMS upload process	Exploitation statusNot known exploited	FixYes	Published07/12/2022	SeverityHigh
`CVE-2022-23655`Missing server signature validation in OctoberCMS	Exploitation statusNot known exploited	FixNot confirmed	Published02/23/2022	SeverityMedium
`CVE-2022-21705`Authenticated remote code execution in octobercms	Exploitation statusNot known exploited	FixYes	Published02/23/2022	SeverityHigh
`CVE-2021-32649`Authenticated file write leads to remote code execution in october/system	Exploitation statusNot known exploited	FixYes	Published01/14/2022	SeverityHigh
`CVE-2021-32650`Arbitrary code execution in october/system	Exploitation statusPublic exploit	FixYes	Published01/14/2022	SeverityHigh
`CVE-2021-41126`Deleted Admin Can Sign In to Admin Interface	Exploitation statusNot confirmed	FixYes	Published10/06/2021	SeverityHigh
`CVE-2021-29487`Authentication bypass in Octobercms	Exploitation statusNot confirmed	FixYes	Published08/26/2021	SeverityHigh
`CVE-2021-32648`Account Takeover in Octobercms	Exploitation statusKEV	FixYes	Published08/26/2021	SeverityHigh
`CVE-2021-21264`Bypass of fix for CVE-2020-26231, Twig sandbox escape	Exploitation statusNot confirmed	FixYes	Published05/03/2021	SeverityMedium
`CVE-2021-21265`October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers	Exploitation statusNot confirmed	FixNot confirmed	Published03/10/2021	SeverityMedium
`CVE-2021-3311`	Exploitation statusNot confirmed	FixNot confirmed	Published02/05/2021	SeverityUnknown
`CVE-2020-26231`Bypass of fix for CVE-2020-15247, Twig sandbox escape	Exploitation statusNot confirmed	FixYes	Published11/23/2020	SeverityMedium
`CVE-2020-15249`Stored XSS by authenticated backend user with access to upload files	Exploitation statusNot confirmed	FixYes	Published11/23/2020	SeverityLow
`CVE-2020-15248`Privilege escalation by backend users assigned to the default "Publisher" system role	Exploitation statusNot confirmed	FixYes	Published11/23/2020	SeverityMedium
`CVE-2020-15247`Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.	Exploitation statusNot confirmed	FixYes	Published11/23/2020	SeverityMedium
`CVE-2020-15246`Local File Inclusion by unauthenticated users	Exploitation statusNot confirmed	FixYes	Published11/23/2020	SeverityHigh
`CVE-2020-15128`Reliance on Cookies without validation in OctoberCMS	Exploitation statusNot confirmed	FixYes	Published07/31/2020	SeverityMedium
`CVE-2020-11083`Stored XSS in October	Exploitation statusNot confirmed	FixYes	Published07/14/2020	SeverityLow
`CVE-2020-4061`Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites	Exploitation statusNot confirmed	FixYes	Published07/02/2020	SeverityLow
`CVE-2020-5299`Potential CSV Injection vector in OctoberCMS	Exploitation statusNot confirmed	FixYes	Published06/03/2020	SeverityMedium
`CVE-2020-5296`Arbitrary File Deletion vulnerability in OctoberCMS	Exploitation statusNot confirmed	FixYes	Published06/03/2020	SeverityMedium
`CVE-2020-5297`Upload whitelisted files to any directory in OctoberCMS	Exploitation statusNot confirmed	FixYes	Published06/03/2020	SeverityLow
`CVE-2020-5298`Reflected XSS when importing CSV in OctoberCMS	Exploitation statusNot confirmed	FixYes	Published06/03/2020	SeverityMedium
`CVE-2020-5295`Local File read vulnerability in OctoberCMS	Exploitation statusNot confirmed	FixYes	Published06/03/2020	SeverityMedium
`CVE-2018-1999009`	Exploitation statusNot confirmed	FixYes	Published07/23/2018	SeverityUnknown
`CVE-2018-1999008`	Exploitation statusNot confirmed	FixYes	Published07/23/2018	SeverityUnknown
`CVE-2018-7198`	Exploitation statusPublic exploit	FixNot confirmed	Published02/18/2018	SeverityUnknown
`CVE-2017-16941`	Exploitation statusNot confirmed	FixNot confirmed	Published11/25/2017	SeverityUnknown
`CVE-2017-1000193`	Exploitation statusNot confirmed	FixNot confirmed	Published11/17/2017	SeverityUnknown
`CVE-2017-1000195`	Exploitation statusNot confirmed	FixNot confirmed	Published11/17/2017	SeverityUnknown
`CVE-2017-1000194`	Exploitation statusNot confirmed	FixNot confirmed	Published11/17/2017	SeverityUnknown
`CVE-2017-1000197`	Exploitation statusNot confirmed	FixNot confirmed	Published11/17/2017	SeverityUnknown
`CVE-2017-1000196`	Exploitation statusNot confirmed	FixNot confirmed	Published11/17/2017	SeverityUnknown
`CVE-2017-16244`	Exploitation statusPublic exploit	FixNot confirmed	Published11/01/2017	SeverityUnknown
`CVE-2017-15284`	Exploitation statusPublic exploit	FixNot confirmed	Published10/12/2017	SeverityUnknown
`CVE-2017-1000119`	Exploitation statusNot confirmed	FixNot confirmed	Published10/04/2017	SeverityUnknown
`CVE-2015-5613`	Exploitation statusNot confirmed	FixNot confirmed	Published09/27/2017	SeverityUnknown
`CVE-2015-5612`	Exploitation statusNot confirmed	FixNot confirmed	Published09/04/2015	SeverityUnknown

62 / 62 Results

All vulnerabilities loaded

Security vulnerabilities in october

october

How many security vulnerabilities does october currently have?

Does the latest version of october have any known vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management