Openkm Openkm
16 CVEs affecting Openkm Openkm. Latest disclosed: 2025-11-05. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2131 | High | 8.5 | 2022-07-25 | OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowin… |
CVE-2021-33950 | High | 7.5 | 2023-02-17 | An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function. |
CVE-2019-11445 | High | 7.2 | 2019-04-22 | OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the sit… |
CVE-2024-35475 | Medium | 6.4 | 2024-05-22 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/Da… |
CVE-2025-57244 | Medium | 5.4 | 2025-11-05 | OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags a… |
CVE-2023-50072 | Medium | 5.4 | 2024-01-13 | A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to up… |
CVE-2022-47414 | Medium | 5.4 | 2023-02-07 | If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality. |
CVE-2022-47413 | Medium | 5.4 | 2023-02-07 | Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition. |
CVE-2022-40317 | Medium | 5.4 | 2022-09-09 | OpenKM 6.3.11 allows stored XSS related to the javascript: substring in an A element. |
CVE-2014-8957 | Medium | 5.4 | 2017-10-06 | Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 allows remote authenticated users to inject arbitrary web script or HTML via the Tasks paramet… |
CVE-2021-3628 | Medium | 4.6 | 2021-08-30 | OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by… |
CVE-2022-3969 | Low | 2.6 | 2022-11-13 | A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/ja… |
CVE-2014-9017 | | 2015-03-11 | Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338) allows remote authenticated users to inject arbitrary web script or HTML via the… | |
CVE-2012-2316 | | 2012-09-09 | Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to… | |
CVE-2012-2315 | | 2012-09-09 | admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated us… | |
CVE-2008-2226 | | 2008-05-14 | Unspecified vulnerability in the export feature in OpenKM before 2.0 allows remote attackers to export arbitrary documents via unspecified vectors. NOTE: some… |