# Octobercms October


- [CVE-2021-32648](https://insights.sbomify.com/CVE-2021-32648/): October CMS Improper Authentication (high 8.2, exploited in the wild)
- [CVE-2021-3311](https://insights.sbomify.com/CVE-2021-3311/): October CMS Session ID not invalidated after logout (critical 9.8)
- [CVE-2017-1000194](https://insights.sbomify.com/CVE-2017-1000194/): October CMS File Upload Vulnerability (critical 9.8)
- [CVE-2017-1000196](https://insights.sbomify.com/CVE-2017-1000196/): Code injection in n/a (critical 9.8)
- [CVE-2017-1000197](https://insights.sbomify.com/CVE-2017-1000197/): Path traversal in n/a (critical 9.8)
- [CVE-2023-44382](https://insights.sbomify.com/CVE-2023-44382/): October CMS safe mode bypass using Twig sandbox escape (critical 9.1)
- [CVE-2021-32649](https://insights.sbomify.com/CVE-2021-32649/): Authenticated file write leads to remote code execution in october/system (high 8.8)
- [CVE-2021-32650](https://insights.sbomify.com/CVE-2021-32650/): Arbitrary code execution in october/system (high 8.8)
- [CVE-2017-16941](https://insights.sbomify.com/CVE-2017-16941/): File upload in n/a (high 8.8)
- [CVE-2017-16244](https://insights.sbomify.com/CVE-2017-16244/): October CMS CSRF (high 8.8)
- [CVE-2022-24800](https://insights.sbomify.com/CVE-2022-24800/): Race Condition in October CMS upload process (high 8.1)
- [CVE-2018-1999009](https://insights.sbomify.com/CVE-2018-1999009/): October CMS Local File Inclusion (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/products/octobercms/october/