Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2017-15284
3.5
LOWCVSS v2
Published
October 12, 2017
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
GitHub