GHSA-w62v-q77r-66ccMediumCVSS 5.4

Alkacon OpenCMS XSS via Mercury template

Published
December 13, 2023
Last Modified
June 20, 2025

🔗 CVE IDs covered (1)

CVE-2023-6379 →

📋 Description

Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.

🎯 Affected products1

  • maven/org.opencms:opencms-core:>= 14.0.0, < 16.0.0

🔗 References (4)