Executive brief
Cross-site Scripting in October
Affected products
- Packagist october/backend
Junglewise Threat Intelligence
CVE-2020-4061: Cross-site Scripting in October
CVE-2020-4061 · Severity: low · CVSS 3.1 · Published 2020-07-02
Technologies: october/backend (Packagist). Vendors: Packagist.
Related threats
- October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
- Stored XSS by authenticated backend user with access to upload files
- Privilege escalation by backend users assigned to the default "Publisher" system role
- Stored XSS in October
- Potential CSV Injection vector in OctoberCMS