CVE-2026-3967 | Medium | 6.3 | 2026-03-12 | A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-co… |
CVE-2020-18327 | Medium | 6.1 | 2022-03-04 | Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowse… |
CVE-2021-41792 | Medium | 5.3 | 2021-10-21 | An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted H… |
CVE-2021-41791 | Medium | 5.4 | 2021-10-21 | An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input… |
CVE-2021-41790 | High | 8.8 | 2021-10-21 | An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of… |
CVE-2020-15181 | Critical | 9.3 | 2020-09-18 | The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using… |
CVE-2020-25728 | High | 8.8 | 2020-09-17 | The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account p… |
CVE-2020-8778 | Medium | 5.4 | 2020-03-02 | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a… |
CVE-2020-8777 | Medium | 5.4 | 2020-03-02 | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in… |
CVE-2020-8776 | Medium | 5.4 | 2020-03-02 | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file. |
CVE-2019-19496 | Medium | 5.4 | 2019-12-02 | Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document. |
CVE-2019-14223 | Medium | 6.1 | 2019-09-06 | An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect a… |
CVE-2019-14224 | High | 7.2 | 2019-09-05 | An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications, an exploit chain was… |
CVE-2019-14222 | Critical | 9.8 | 2019-09-05 | An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Adm… |
CVE-2019-15566 | Critical | 9.8 | 2019-08-26 | The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java. |
CVE-2015-3366 | | | 2015-04-21 | Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitr… |
CVE-2014-9302 | | | 2014-12-07 | Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition… |
CVE-2014-9301 | | | 2014-12-07 | Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound re… |
CVE-2014-9300 | | | 2014-12-07 | Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition… |
CVE-2014-2939 | | | 2014-06-02 | Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1… |