Alkacon Opencms
33 CVEs affecting Alkacon Opencms. Latest disclosed: 2026-02-19. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-8811 | High | 8.8 | 2018-03-20 | Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authen… |
CVE-2019-11819 | High | 7.8 | 2019-05-08 | Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp… |
CVE-2024-42699 | Medium | 6.5 | 2025-04-21 | Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image titl… |
CVE-2021-3312 | Medium | 6.5 | 2021-10-08 | An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate file… |
CVE-2024-5521 | Medium | 6.4 | 2024-05-30 | Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user having the roles of gallery e… |
CVE-2024-5520 | Medium | 6.4 | 2024-05-30 | Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to… |
CVE-2026-2736 | Medium | 6.1 | 2026-02-19 | Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the vic… |
CVE-2023-6380 | Medium | 6.1 | 2023-12-13 | Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially… |
CVE-2023-37602 | Medium | 6.1 | 2023-07-20 | An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading… |
CVE-2019-13236 | Medium | 6.1 | 2019-08-27 | In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface. |
CVE-2019-11818 | Medium | 6.1 | 2019-05-08 | Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.j… |
CVE-2026-2735 | Medium | 5.4 | 2026-02-19 | Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-… |
CVE-2024-41446 | Medium | 5.4 | 2025-04-21 | A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2024-41447 | Medium | 5.4 | 2025-04-18 | A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2023-6379 | Medium | 5.4 | 2023-12-13 | Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a… |
CVE-2023-31544 | Medium | 5.4 | 2023-05-16 | A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2021-25968 | Medium | 5.4 | 2021-10-19 | In “OpenCMS”, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in t… |
CVE-2018-8815 | Medium | 4.6 | 2018-03-20 | Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a… |
CVE-2015-2351 | | 2015-03-19 | Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the… | |
CVE-2013-4600 | | 2013-08-09 | Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) t… |