Sploitus

21 exploited vulnerabilities in October Cms

Vulnerabilities with publicly known exploits

Vendors
Unknown, October, Rainlab
With known exploits
21
Affected Octobercms October versions
< 1.1.5, 1.0.471, 1.0.426, 1.0.412, 1.0.466, 1.0.431, 1.0.425

Vulnerabilities with exploits

Highest CVSS first — 10 of these already have exploit code on Sploitus

CVE-2021-32648 1 exploit
CVSS 9.4 CRITICAL 2021-08-26FIX AVAILABLE
Exploit for Improper Authentication in Octobercms October
CVE-2021-32650
CVSS 8.8 HIGH 2022-01-14FIX AVAILABLE
CVE-2017-16244 4 exploits
CVSS 8.8 HIGH 2017-11-01
OctoberCMS 1.0.426 (Build 426) Cross Site Request ForgeryOctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery Vulnerability
CVE-2022-21705
CVSS 8.5 HIGH 2022-02-23FIX AVAILABLE
CVE-2022-24800
CVSS 8.1 HIGH 2022-03-29FIX AVAILABLE
CVE-2023-25365
CVSS 7.8 HIGH 2024-02-08FIX AVAILABLE
CVE-2022-35944
CVSS 7.2 HIGH 2022-10-13FIX AVAILABLE
CVE-2017-1000119 2 exploits
CVSS 7.2 HIGH 2017-10-04FIX AVAILABLE
October CMS - Upload Protection Bypass Code Execution (Metasploit)October CMS Upload Protection Bypass Code Execution
CVE-2020-5296 2 exploits
CVSS 6.2 MEDIUM 2020-06-03FIX AVAILABLE
October CMS Build 465 XSS / File Read / File Deletion / CSV InjectionOctober CMS Build 465 XSS / File Read / File Deletion / CSV Injection Vulnerabilities
CVE-2018-7198 3 exploits
CVSS 6.1 MEDIUM 2018-02-18FIX AVAILABLE
October CMS < 1.0.431 - Cross-Site Scripting VulnerabilityOctober CMS Cross Site Scripting
CVE-2023-43876
CVSS 5.4 MEDIUM 2023-09-28
CVE-2023-37692
CVSS 5.4 MEDIUM 2023-07-26FIX AVAILABLE
CVE-2022-23655
CVSS 5.4 MEDIUM 2022-02-20FIX AVAILABLE
CVE-2020-4061
CVSS 5.4 MEDIUM 2020-07-02FIX AVAILABLE
CVE-2017-15284 4 exploits
CVSS 5.4 MEDIUM 2017-10-12FIX AVAILABLE
OctoberCMS 1.0.425 Cross Site Scripting VulnerabilityOctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting
CVE-2024-51991
CVSS 4.9 MEDIUM 2025-05-05FIX AVAILABLE
CVE-2020-5295 3 exploits
CVSS 4.8 MEDIUM 2020-06-03FIX AVAILABLE
October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)October CMS Build 465 XSS / File Read / File Deletion / CSV Injection
CVE-2020-5298 2 exploits
CVSS 4.0 MEDIUM 2020-06-03FIX AVAILABLE
October CMS Build 465 XSS / File Read / File Deletion / CSV InjectionOctober CMS Build 465 XSS / File Read / File Deletion / CSV Injection Vulnerabilities
CVE-2020-5297 2 exploits
CVSS 4.0 MEDIUM 2020-06-03FIX AVAILABLE
October CMS Build 465 XSS / File Read / File Deletion / CSV InjectionOctober CMS Build 465 XSS / File Read / File Deletion / CSV Injection Vulnerabilities
CVE-2020-11083 2 exploits
CVSS 3.5 LOW 2020-07-14FIX AVAILABLE
October CMS Build 465 XSS / File Read / File Deletion / CSV InjectionOctober CMS Build 465 XSS / File Read / File Deletion / CSV Injection Vulnerabilities
CVE-2015-5613
CVSS 3.5 LOW 2017-09-27FIX AVAILABLE