PT-2026-1832 · October · October

CVE-2025-61674 · Publicado 2026-01-09 · Atualizado 2026-01-10

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.13 October versions prior to 4.0.12

Description October is a Content Management System (CMS) and web platform. A cross-site scripting (XSS) issue exists in October CMS backend configuration forms. A user possessing the Global Editor Settings permission can inject malicious HTML/JS into the stylesheet input at Markup Styles. A crafted input can bypass the intended context, enabling arbitrary script execution across backend pages for all users. The vulnerability affects the backend configuration forms and specifically involves the stylesheet input at Markup Styles.

Recommendations Update to October version 3.7.13 or later. Update to October version 4.0.12 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-61674

GHSA-GXXC-M74C-F48X

Produtos afetados

October

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61674.json · Exploit
• https://github.com/octobercms/october/security/advisories/GHSA-gxxc-m74c-f48x · Aviso do Fabricante
• https://github.com/octobercms/october · Nota
• https://osv.dev/vulnerability/CVE-2025-61674 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gxxc-m74c-f48x · Aviso do Fabricante
• https://t.me/CVEtracker/41908 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2009899997739835642 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-61674 · Nota de Segurança