CVE-2025-61674: fallo de gravedad media en octobercms october
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Productos afectados
octobercms · octoberCVEs relacionadas — octobercms october
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-32648HIGHAccount Takeover in OctobercmsEPSS 91.2%KEVCVE-2022-21705HIGHAuthenticated remote code execution in octobercmsEPSS 8.6%CVE-2020-5295MEDIUMLocal File read vulnerability in OctoberCMSEPSS 7.4%CVE-2021-32650HIGHArbitrary code execution in october/systemEPSS 2.2%CVE-2021-21265MEDIUMOctober CMS vulnerable to Potential Host Header Poisoning on misconfigured serversEPSS 1.7%CVE-2020-15246HIGHLocal File Inclusion by unauthenticated usersEPSS 1.7%