October CMS: Reflected XSS via DataTable Form Widget
A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. ### Impact - Reflected XSS only, no stored/persistent component - The backend URL prefix is customizable and must be known or guessed by the attacker - Requires an authenticated backend user to visit a crafted URL - No direct access is gained without social engineering ### Patches The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version. ### Workarounds - Use a non-default backend URL prefix (recommended as standard practice) - Implement a Content Security Policy (CSP) for backend pages
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27937US | — | — | ||
October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTa… | ||||
references
External citations — patches, advisories, analysis.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan