All packages
Alkacon OpenCms vulnerabilities
3 known CVE vulnerabilities in Alkacon OpenCms, translated and rated.
- CVE-2023-42346High
Alkacon OpenCms before version 16 allows XXE when the <!DOCTYPE> refers to an external host.
- CVE-2023-42344High
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
- CVE-2024-41446Medium
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.