CVE-2026-24906

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Exploitation could lead to privilege escalation if a superuser opens any RichEditor during routine content editing (e.g., editing a blog post), and requires authenticated backend access with editor settings permissions. This issue has been fixed in versions 3.7.14 and 4.1.10. To workaround this issue, restrict editor settings permissions to fully trusted administrators only

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 14, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-249075.4October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSCVE-2026-249086.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injeCVE-2026-249095.9vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.CVE-2026-24916.3Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authenticatiCVE-2026-249105.9In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matchCVE-2026-249118.6Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service.CVE-2026-249128.6The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the saCVE-2026-249138.7SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the databaCVE-2026-249145.5Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249157.1Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidenCVE-2026-249165.5Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service CVE-2026-249175.5UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.