Medium severity6.1NVD Advisory· Published Nov 17, 2017· Updated May 13, 2026

CVE-2017-1000193

Description

October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
october/octoberPackagist	< 1.0.413	1.0.413

Affected products

Octobercms/October
cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
Range: <=1.0.412

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/octobercms/october/compare/v1.0.412...v1.0.413nvdPatchWEB
github.com/advisories/GHSA-3p6c-9xhm-8x7hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2017-1000193ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000