18 results · Clear filters · Feed
-
Medium 6.1
Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
-
Medium 6.1CVE-2023-42343 Scanner template
Alkacon OpenCms is vulnerable to XSS via cmis-online/type
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
-
Medium 5.4
OpenCMS cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.
-
Medium 6.5
OpenCMS Cross-Site Scripting vulnerability
Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field
-
Medium 5.4
Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function.
-
Medium 6.4
Cross-Site Scripting stored in Alkacon OpenCMS
Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after i…
-
Medium 5.4CVE-2023-6379 Scanner template
Cross-site Scripting in Alkacon Software OpenCms
Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take contr…
-
Medium 6.1
Alkacon OpenCMS arbitrary file upload vulnerability
An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
-
Medium 5.4
alkacon-OpenCMS vulnerable to stored Cross-site Scripting
A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.
-
Medium 6.5
XML External Entity Reference in org.opencms:opencms-core
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
-
Medium 4.3CVE-2019-13237 Public exploit
Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workp…
-
Medium 6.1CVE-2019-13236 Public exploit
XSS issues in the management interface
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
-
Medium 6.1CVE-2019-13235 Public exploit
XSS in login form
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
-
Medium 6.1CVE-2019-13234 Public exploit
XSS in search engine
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
-
Medium —CVE-2008-1301 Public exploit
Alkacon OpenCMS Absolute Path Traversal via pathname in filePath.0 parameter
Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.
-
Medium —
Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp
system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/a…
-
Medium —
Alkacon OpenCms Exposes JSP Source Code
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
-
Medium —
Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.