漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Vulnerability Description
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
October CMS 跨站脚本漏洞
Vulnerability Description
October CMS是October CMS公司的一套基于PHP和Laravel Web应用程序框架的开源内容管理系统（CMS）。 October CMS 3.7.13之前版本和4.0.12之前版本存在跨站脚本漏洞，该漏洞源于后端配置表单中清理和转义不足，可能导致跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A