CVE-2023-42343: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type...

CVE-2023-42343

A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type...

CVE-2023-42343

A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type...

CVE-2023-42346

Alkacon OpenCms before 16 allows XXE when the refers to an external host...

Alkacon OpenCMS security vulnerabilities

Alkacon OpenCMS is a content management system developed by Alkacon Corporation. Previous versions of Alkacon OpenCMS, such as OpenCMS 16, had security vulnerabilities. These vulnerabilities stemmed from XXE attacks when DOCTYPE references external hosts...

CVE-2023-42345

Alkacon OpenCMS versions prior to 16 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is a lack of sufficient protection for the web page structure, specifically within the updateModelGroups.jsp file. A remote attacker can exploit this flaw to perform cross-site script...

Alkacon OpenCMS cross-site scripting vulnerability

Alkacon OpenCMS is a content management system developed by Alkacon Corporation. Versions of Alkacon OpenCMS prior to 10.5.1 had a cross-site scripting vulnerability, which was caused by the cmis-online/type module being vulnerable to cross-site scripting attacks...

CVE-2023-42344

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet...

CVE-2023-42346

Alkacon OpenCms before 16 allows XXE when the refers to an external host...

CVE-2023-42344

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

XML External Entity (XXE) Injection

Overview org.opencms:opencms-core is a Java open source content management system by Alkacon Software. Affected versions of this package are vulnerable to XML External Entity XXE Injection insecure XML parsing of user-supplied .zip files containing manifest.xml in the Admin Import DB. An attacker...

EUVD-2026-27401

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

PT-2026-37087

Name of the Vulnerable Software and Affected Versions OpenCMS versions prior to 21 Description The Admin Import DB feature is susceptible to XML External Entity XXE, a flaw where an application processes XML input containing a reference to an external entity, potentially allowing unauthorized...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

The OpenCMS content management system (versions v20 and before ) is vulnerable to an XML External Entity (XXE) injection flaw. The issue exists in the Admin Import DB feature because the application performs insecure XML parsing on user-supplied .zip files that contain a manifest.xml file. An att...