CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL-Execution vulnerability exploitable by authenticated administrators via the DatabaseQuery interface. Attackers can send crafted SQL in the qs parameter to /admin/DatabaseQuery to read sensitive data (e.g., usernames and password hashes from the OKM_USER ...

PT-2026-43254

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

📄 OpenKM Community Edition 6.3.10 Code Execution / LFI / SQL Injection

OpenKM Community Edition version 6.3.10 proof of concept Metasploit module that exploits local file inclusion, remote code execution, and SQL injection vulnerabilities...

CVE-2024-35475

OpenKM Community Edition versions 6.3.12 and earlier are affected by CVE-2024-35475, a CSRF vulnerability in the /admin/DatabaseQuery endpoint. The issue allows an attacker with administrative privileges to instruct the victim to execute arbitrary SQL commands. Impact is described as potential ma...

OpenKM 安全漏洞

OpenKM is a document management system from the Spanish company OpenKM. The system provides features such as version control, document history and file sharing. A security vulnerability exists in OpenKM 6.3.12 and earlier versions, which stems from a cross-site request forgery CSRF vulnerability ...

PT-2024-26513

Name of the Vulnerable Software and Affected Versions OpenKM Community Edition versions 6.3.12 and earlier Description A Cross-Site Request Forgery CSRF issue was found in the "admin/DatabaseQuery" endpoint, allowing an attacker to manipulate a victim with administrative privileges into executing...