CVE-2020-11083

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.

• CWE-79
• CWE-79

• http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Aug/2Exploit, Mailing List, Third Party Advisory
• https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgvPatch, Third Party Advisory
• https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94Patch, Third Party Advisory
• http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Aug/2Exploit, Mailing List, Third Party Advisory
• https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgvPatch, Third Party Advisory
• https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94Patch, Third Party Advisory

Published

Jul 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11078In httplib2 before version 0.18.0, an attacker controlling u…6.8
• CVE-2020-11079node-dns-sync (npm module dns-sync) through 0.2.0 allows exe…9.8
• CVE-2020-1108A denial of service vulnerability exists when .NET Core or .…7.5
• CVE-2020-11080In nghttp2 before version 1.41.0, the overly large HTTP/2 SE…7.5
• CVE-2020-11081osquery before version 4.4.0 enables a privilege escalation …8.2
• CVE-2020-11082In Kaminari before 1.2.1, there is a vulnerability that woul…6.1
• CVE-2020-11084In iPear, the manual execution of the eval() function can le…5.4
• CVE-2020-11085In FreeRDP before 2.1.0, there is an out-of-bounds read in c…3.5
• CVE-2020-11086In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4
• CVE-2020-11087In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4
• CVE-2020-11088In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4
• CVE-2020-11089In FreeRDP before 2.1.0, there is an out-of-bound read in ir…5.5