rainlab vulnerabilities

Products

• rainlab/blog-plugin 1
• rainlab/debugbar-plugin 1
• rainlab/user-plugin 1

Latest rainlab CVEs

Newest publication first

1. CVE-2020-11094 Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar

   Published 2020-06-03

   Critical·CVSS 9.8 EPSS 1.0%

   The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to...

2. CVE-2018-10366 User Plugin for October CSS Allows XSS

   Published 2018-04-25

   Medium·CVSS 6.1 EPSS 2.4% Public exploit

   An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.

3. CVE-2018-7198 October CMS - RainLab Blog Plugin XSS

   Published 2018-02-18

   Medium·CVSS 6.1 EPSS 2.3% Public exploit

   October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.