CVE-2025-61676

October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms. A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Styles from Branding & Appearance settings. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.

• CWE-79

• https://github.com/octobercms/october/security/advisories/GHSA-wvpq-h33f-8rp6Patch, Vendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61670Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 3…3.3
• CVE-2025-61671Rejected reason: Further research determined the issue is no…
• CVE-2025-61672Synapse is an open source Matrix homeserver implementation. …5.3
• CVE-2025-61673Karapace is an open-source implementation of Kafka REST and …8.6
• CVE-2025-61674October is a Content Management System (CMS) and web platfor…4.8
• CVE-2025-61675FreePBX Endpoint Manager is a module for managing telephony …8.6
• CVE-2025-61677DataChain is a Python-based AI-data warehouse for transformi…2.5
• CVE-2025-61678FreePBX Endpoint Manager is a module for managing telephony …8.6
• CVE-2025-61679Anyquery is an SQL query engine built on top of SQLite. Vers…7.7
• CVE-2025-6168An issue has been discovered in GitLab EE affecting all vers…2.7
• CVE-2025-61680Minecraft RCON Terminal is a VS Code extension that streamli…6.6
• CVE-2025-61681KUNO CMS is a fully deployable full-stack blog application. …5.4