LOW3.7Packagist
GHSA-3pc2-fm7p-q2vg· CVE-2020-4061Cross-site Scripting in October
Modified: 7/8/2026
package
Packagist/october/backend
pkg:packagist/october/backend
MEDIUM4.0Packagist
GHSA-4rhm-m2fp-hx7q· CVE-2020-5299Potential CSV Injection vector in OctoberCMS
Modified: 7/8/2026
LOW2.8Packagist
GHSA-fx3v-553x-3c4q· CVE-2020-15249Stored XSS by authenticated backend user with access to upload files
Modified: 7/8/2026
MEDIUM4.0Packagist
GHSA-gg6x-xx78-448c· CVE-2020-5298Reflected XSS when importing CSV in OctoberCMS
Modified: 7/8/2026
MEDIUM4.0Packagist
GHSA-rfjc-xrmf-5vvw· CVE-2020-15248Privilege escalation by backend users assigned to the default "Publisher" system role
Modified: 7/8/2026
LOW3.5Packagist
GHSA-w4pj-7p68-3vgv· CVE-2020-11083Stored XSS in October
Modified: 9/10/2026
LOWPackagist
GHSA-xhfx-hgmf-v6vp· CVE-2021-21265October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
Modified: 7/8/2026