org.opencms:opencms-core

Maven28 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting org.opencms:opencms-corepage 1 of 1

CVE-2005-4294NONECVSS 0.0EG 0.0✓ Fixed in 6.0.3
2005-12-16
Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page.
CVE-2006-2571NONECVSS 0.0EG 0.0✓ Fixed in 6.0.4
2006-05-24
Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action.
CVE-2006-3933NONECVSS 0.0EG 0.0✓ Fixed in 6.2.2
2006-07-31
Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script or HTML via the message body.
CVE-2006-3934NONECVSS 0.0EG 0.0✓ Fixed in 6.2.2
2006-07-31
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
CVE-2006-3935NONECVSS 0.0EG 0.0✓ Fixed in 6.2.2
2006-07-31
system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2…
CVE-2006-3936NONECVSS 0.0EG 0.0✓ Fixed in 6.2.2
2006-07-31
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
CVE-2008-1045NONECVSS 0.0EG 0.0✓ Fixed in 7.0.4
2008-02-27
Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parame…
CVE-2008-1300NONECVSS 0.0EG 0.0✓ Fixed in 7.0.5
2008-03-12
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web scr…
CVE-2008-1301NONECVSS 0.0EG 0.0✓ Fixed in 7.0.5
2008-03-12
Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the …
CVE-2008-1510NONECVSS 0.0EG 0.0✓ Fixed in 7.0.4
2008-03-25
Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.
CVE-2008-1753NONECVSS 0.0EG 0.0✓ Fixed in 7.0.4
2008-04-11
Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the searchfilter parameter, a different vector than CVE-2…
CVE-2013-4600NONECVSS 0.0EG 0.0✓ Fixed in 8.5.2
2013-08-09
vulnerable: 8.0.1 ... 8.5.1 (8 versions)
Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to system/workplace/views/admin/admin-main.jsp or the (2) request…
CVE-2015-2351NONECVSS 0.0EG 0.0✓ Fixed in 9.5.2
2015-03-19
vulnerable: 8.0.1 ... 9.5.1 (13 versions)
Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates…
CVE-2019-11818MEDIUMCVSS 6.1EG 6.1✓ Fixed in 11.0.0
2019-05-08
vulnerable: 10.0.0 ... 9.5.3 (22 versions)
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First…
CVE-2019-11819HIGHCVSS 7.8EG 7.8✓ Fixed in 11.0.0
2019-05-08
vulnerable: 10.0.0 ... 9.5.3 (22 versions)
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.
CVE-2019-13234MEDIUMCVSS 6.1EG 6.1✓ Fixed in 11.0.1
2019-08-27
vulnerable: 10.0.0 ... 9.5.3 (23 versions)
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
CVE-2019-13235MEDIUMCVSS 6.1EG 6.1✓ Fixed in 11.0.1
2019-08-27
vulnerable: 10.0.0 ... 9.5.3 (23 versions)
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
CVE-2019-13236MEDIUMCVSS 6.1EG 6.1✓ Fixed in 11.0.1
2019-08-27
vulnerable: 10.0.0 ... 9.5.3 (23 versions)
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
CVE-2019-13237MEDIUMCVSS 4.3EG 4.3✓ Fixed in 11.0.1
2019-08-27
vulnerable: 10.0.0 ... 9.5.3 (23 versions)
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.js…
CVE-2021-3312MEDIUMCVSS 6.5EG 6.5✓ Fixed in 12.0.0
2021-10-08
vulnerable: 11.0.0, 11.0.1, 11.0.2
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
CVE-2023-31544MEDIUMCVSS 5.4EG 5.4✓ Fixed in 11.0.1
2023-05-16
vulnerable: 10.0.0 ... 9.5.3 (23 versions)
A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.
CVE-2023-37602MEDIUMCVSS 6.1EG 6.1
2023-07-20
vulnerable: 10.0.0 ... 9.5.3 (29 versions)
An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVE-2023-42343MEDIUMCVSS 6.1EG 6.1✓ Fixed in 16.0
2026-05-08
vulnerable: 10.0.0 ... 9.5.3 (29 versions)
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
CVE-2023-42344HIGHCVSS 7.3EG 7.3✓ Fixed in 10.5.1
2026-05-08
vulnerable: 10.0.0 ... 9.5.3 (18 versions)
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
CVE-2023-42345MEDIUMCVSS 6.1EG 6.1✓ Fixed in 16.0
2026-05-08
vulnerable: 10.0.0 ... 9.5.3 (29 versions)
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
CVE-2023-42346HIGHCVSS 7.5EG 7.5✓ Fixed in 16.0
2026-05-08
vulnerable: 10.0.0 ... 9.5.3 (29 versions)
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
CVE-2023-6379MEDIUMCVSS 5.4EG 5.4✓ Fixed in 16.0.0
2023-12-13
vulnerable: 14.0, 15.0
Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and …
CVE-2024-5520MEDIUMCVSS 6.4EG 6.4✓ Fixed in 17.0
2024-05-30
vulnerable: 16.0
Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to create and modify web pages through the admin panel, can execute malicious Jav…

Check whether org.opencms:opencms-core is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.opencms:opencms-core CVEs against the assets you own.

Start Free Scan →