Alkacon

Opencms

36 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2024-5520

  • EPSS 0.29%
  • Veröffentlicht 30.05.2024 12:15:10
  • Zuletzt bearbeitet 23.04.2025 19:47:13

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code...

6.1

CVE-2023-6380

  • EPSS 1.59%
  • Veröffentlicht 13.12.2023 11:15:07
  • Zuletzt bearbeitet 21.11.2024 08:43:44

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compro...

6.1

CVE-2023-6379

  • EPSS 1.77%
  • Veröffentlicht 13.12.2023 11:15:07
  • Zuletzt bearbeitet 21.11.2024 08:43:44

Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially t...

6.1

CVE-2023-37602

Exploit
  • EPSS 0.59%
  • Veröffentlicht 20.07.2023 19:15:10
  • Zuletzt bearbeitet 21.11.2024 08:12:01

An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.

5.4

CVE-2023-31544

Exploit
  • EPSS 0.4%
  • Veröffentlicht 16.05.2023 21:15:09
  • Zuletzt bearbeitet 23.01.2025 18:15:28

A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.

5.4

CVE-2021-25968

  • EPSS 0.5%
  • Veröffentlicht 19.10.2021 09:15:07
  • Zuletzt bearbeitet 21.11.2024 05:55:41

In “OpenCMS”, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open t...

6.5

CVE-2021-3312

Exploit
  • EPSS 1.25%
  • Veröffentlicht 08.10.2021 15:15:09
  • Zuletzt bearbeitet 21.11.2024 06:21:15

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

6.1

CVE-2019-13236

Exploit
  • EPSS 3.11%
  • Veröffentlicht 27.08.2019 12:15:12
  • Zuletzt bearbeitet 21.11.2024 04:24:30

In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.

7.8

CVE-2019-11819

Exploit
  • EPSS 1%
  • Veröffentlicht 08.05.2019 16:29:00
  • Zuletzt bearbeitet 21.11.2024 04:21:49

Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.

6.1

CVE-2019-11818

Exploit
  • EPSS 0.77%
  • Veröffentlicht 08.05.2019 16:29:00
  • Zuletzt bearbeitet 21.11.2024 04:21:49

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or La...