OpenCMS Data Compromise

The vulnerability of the OpenCMS content management system is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to influence the confidentiality, integrity, and accessibility of information...

OpenCMS XSS

The vulnerability of the OpenCMS content management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

OpenCMS Unauthenticated XXE Vulnerability (CVE-2023-42344)

OpenCms is a popular open-source Java framework developed by Alkacon Software. OpenCms provides a platform for users to design and develop web applications. The latest version of the framework is 16.0. About CVE-2023-42344 CVE-2023-42344 is a critical vulnerability where users can execute code...

OpenCMS XML External Object Code Execution

The vulnerability of the OpenCMS content management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request remotely...

org.opencms:opencms (5.0.1) potentially affected by CVE-2023-22102 via mysql:mysql-connector-java (3.0.8)

mysql:mysql-connector-java MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.opencms:opencms 5.0.1 Source cves: CVE-2023-22102 Source advisory: OSV:GHSA-M6VM-37G8-GQVH...

PT-2023-7554

Name of the Vulnerable Software and Affected Versions OpenCMS affected versions not specified Description The issue is related to the lack of protection for the web page structure in OpenCMS, allowing a remote attacker to conduct cross-site scripting attacks. Recommendations At the moment, there ...

PT-2023-7552

Name of the Vulnerable Software and Affected Versions OpenCMS affected versions not specified Description The issue in OpenCMS is related to the failure to neutralize special elements. This could allow a remote attacker to impact the confidentiality, integrity, and availability of information...

Cross Site Scripting (XSS)

OpenCms is vulnerable to Cross Site Scripting XSS. The vulnerability exists due to the /workplace!explorer component which allows an attacker to inject and execute arbitrary JavaScript via uploading a crafted SVG file...

Alkacon OpenCMS arbitrary file upload vulnerability

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

GHSA-GHG2-3W9X-9599 Alkacon OpenCMS arbitrary file upload vulnerability

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

org.opencms:opencms-webapp (8.0.2) potentially affected by CVE-2023-37602 via org.opencms:opencms-core (8.0.2)

org.opencms:opencms-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-webapp 8.0.2 Source cves: CVE-2023-37602 Source advisory: OSV:GHSA-GHG2-3W9X-9599...

org.opencms:opencms-webapp (8.0.4) potentially affected by CVE-2023-37602 via org.opencms:opencms-core (8.0.4)

org.opencms:opencms-core MAVEN version 8.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-webapp 8.0.4 Source cves: CVE-2023-37602 Source advisory: OSV:GHSA-GHG2-3W9X-9599...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

Privilege escalation

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

CVE-2023-37602 affects Alkacon OpenCMS v15.0, specifically the /workplace#!explorer component. The Arbitrary file upload vulnerability allows an attacker to upload a crafted PNG to execute arbitrary code. The NVD entry reports a CVSS v3.1 base score of 6.1 (Medium) with Network access, Low attack...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602: Improper Neutralization of Input During Web Page Generation

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...