{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T05:43:53.555","vulnerabilities":[{"cve":{"id":"CVE-2024-25637","sourceIdentifier":"security-advisories@github.com","published":"2024-06-26T16:15:10.910","lastModified":"2026-06-17T07:16:20.350","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15.\n"},{"lang":"es","value":"October es una plataforma CMS autohospedada basada en Laravel PHP Framework. El encabezado X-October-Request-Handler no sanitiza el nombre del controlador AJAX y permite que se refleje HTML sin escape. No hay ningún impacto ya que esta vulnerabilidad no se puede explotar mediante interacciones normales del navegador. Este valor sin escape solo es detectable cuando se utiliza una herramienta de interceptación de proxy. Este problema se solucionó en la versión 3.5.15."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"octobercms","product":"october","versions":[{"version":">= 3.2, < 3.5.15","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-06-26T20:53:21.374050Z","id":"CVE-2024-25637","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.0","versionEndExcluding":"3.5.15","matchCriteriaId":"8C52BE43-5841-46A0-B56D-F7043B9FE9BB"}]}]}],"references":[{"url":"https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}