PT-2026-1833 · Octobercms · October

Publicado 2026-01-09 · Atualizado 2026-01-10 · CVE-2025-61676

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.13 October versions prior to 4.0.12

Description October is a Content Management System (CMS) and web platform. A cross-site scripting (XSS) issue exists in October CMS backend configuration forms. A user possessing the Customize Backend Styles permission can inject malicious HTML/JS into the stylesheet input located at Styles within the Branding & Appearance settings. A carefully constructed input can bypass the intended <style> context, potentially enabling arbitrary script execution across backend pages for all users.

Recommendations Update to October version 3.7.13 or later. Update to October version 4.0.12 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-61676

GHSA-WVPQ-H33F-8RP6

Produtos afetados

October

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61676.json · Exploit
• https://github.com/octobercms/october/security/advisories/GHSA-wvpq-h33f-8rp6 · Aviso do Fabricante
• https://github.com/octobercms/october · Nota
• https://osv.dev/vulnerability/GHSA-wvpq-h33f-8rp6 · Aviso do Fabricante
• https://t.me/CVEtracker/41909 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2009897437847052660 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-61676 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-61676 · Aviso do Fabricante