Skip to content
Threat Feed
Subscribe

Vendor

October CMS

2 briefs RSS
high advisory

Server-Side Request Forgery in OctoberCMS

An unauthenticated server-side request forgery (SSRF) vulnerability in OctoberCMS allows remote attackers to manipulate the realSourcePath argument to perform unauthorized internal network requests.

OctoberCMS +1 web-application ssrf
1t 1c
low advisory

Stored XSS in Winter CMS and October CMS Backend

Authenticated backend users can perform stored cross-site scripting (XSS) by injecting malicious content into custom CSS settings in Winter CMS and October CMS.

Winter CMS +2
1t 2c