Headline
GHSA-r47v-rxcg-p28j: Stored Cross-Site Scripting October CMS
An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users.
Stored Cross-Site Scripting October CMS
Moderate severity GitHub Reviewed Published Jul 26, 2023 to the GitHub Advisory Database • Updated Jul 26, 2023
Related news
CVE-2023-37692: October CMS v3.4.4 – Stored Cross-Site Scripting (XSS) (Authenticated)
An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.