Vulnerability Database

322,388

Total vulnerabilities in the database

CVE-2025-61674

October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.

  • Published: Jan 10, 2026
  • Updated: Jan 11, 2026
  • CVE: CVE-2025-61674
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.1
  • AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
octobercms / october - 3.17.3
octobercms / october 4.0.0 4.0.12