CVE-2025-61676: medium-severity vulnerability in octobercms october
October CMS Vulnerable to Stored XSS via Branding Styles
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.3%
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms. A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Styles from Branding & Appearance settings. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Affected products
octobercms · octoberRelated CVEs — octobercms october
In the same product, most dangerous first.
CVE-2021-32648HIGHAccount Takeover in OctobercmsEPSS 91.2%KEVCVE-2022-21705HIGHAuthenticated remote code execution in octobercmsEPSS 8.6%CVE-2020-5295MEDIUMLocal File read vulnerability in OctoberCMSEPSS 7.4%CVE-2021-32650HIGHArbitrary code execution in october/systemEPSS 2.2%CVE-2021-21265MEDIUMOctober CMS vulnerable to Potential Host Header Poisoning on misconfigured serversEPSS 1.7%CVE-2020-15246HIGHLocal File Inclusion by unauthenticated usersEPSS 1.7%