[LOW] October CMS Allows Unprotected SVG Rename in Media Manager

PKSA-1r2f-d74z-j32s CVE-2024-51991 GHSA-96hh-8hx5-cpw7

Affected version: <3.7.5

Reported by:
GitHub

[LOW] October allows an admin account to upload PDF containing malicious JavaScript

PKSA-b37x-tgms-g4z2 CVE-2024-45962 GHSA-hxpp-g76m-qhvg

Affected version: <=3.6.4

Reported by:
GitHub

[HIGH] October CMS Cross-site Scripting vulnerability

PKSA-f5gt-nmcq-d353 CVE-2023-25365 GHSA-gcgj-qh8p-57hm

Affected version: <=3.2.0

Reported by:
GitHub

[MEDIUM] Stored Cross-Site Scripting October CMS

PKSA-mn5j-jgxn-wwt6 CVE-2023-37692 GHSA-r47v-rxcg-p28j

Affected version: <=3.4.4

Reported by:
GitHub

[HIGH] October CMS CSRF

PKSA-qf3x-mnjz-nmxw CVE-2017-16244 GHSA-vm6r-4p4v-232x

Affected version: <=1.0.426

Reported by:
GitHub

[HIGH] October CMS Local File Inclusion

PKSA-bg2c-hjbr-g8th CVE-2018-1999009 GHSA-v7cr-w5v6-6659

Affected version: <1.0.437

Reported by:
GitHub

[MEDIUM] Use of insecure jQuery version in OctoberCMS

PKSA-cgpj-6dtg-1n63 GHSA-v73w-r9xg-7cr9

Affected version: >=1.0.319,<1.0.466

Reported by:
GitHub