PT-2023-26040

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS version 15.0 Description The issue allows attackers to execute arbitrary code via uploading a crafted PNG file, specifically exploiting an arbitrary file upload vulnerability in the component /workplace!explorer. Recommendation...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting Vulnerability

Exploit Title: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting XSS Exploit Author: tmrswrr Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: v15.0 POC: 1 Login in demo page , go to this url...

Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)

Exploit Title: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting XSS Date: 1/07/2023 Exploit Author: tmrswrr Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: v15.0 POC: 1 Login in demo page , go to this url...

Alkacon OpenCMS 15.0 Cross Site Scripting

Exploit Title: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting Date: 1/07/2023 Exploit Author: tmrswrr Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: v15.0 POC: 1 Login in demo page , go to this url...

Cross-site Scripting (XSS)

opencms-gwt is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the generateTooltipHtml function of CmsResultItemWidget.java, which allows an attacker to inject and execute malicious javascript or HTML through the Title field under the upload image module...

GHSA-M44F-9JHG-59CR alkacon-OpenCMS vulnerable to stored Cross-site Scripting

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

alkacon-OpenCMS vulnerable to stored Cross-site Scripting

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

Alkacon Software OpenCMS 跨站脚本漏洞

Alkacon Software OpenCMS is Germany's Alkacon Software a set of open source Java and XML-based content management system CMS. The system supports template engine, WYSIWYG editor and so on. A security vulnerability exists in Alkacon Software OpenCMS version v11.0.0.0. An attacker can exploit the...

CVE-2023-31544

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

CVE-2023-31544

CVE-2023-31544 describes a stored Cross-site Scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 . The issue arises when a crafted payload is injected into the Title field in the Upload Image module , allowing an attacker to execute arbitrary web scripts or HTML in affected contexts. The C...

CVE-2023-31544

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

PT-2023-23381 · Alkacon · Alkacon Opencms

Name of the Vulnerable Software and Affected Versions: alkacon-OpenCMS version 11.0.0.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module. This enables...

CVE-2023-31544

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

CVE-2023-31544: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

CVE-2023-31544

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

GHSA-C8J6-GQQ8-4PRJ Alkacon OpenCMS XSS via New User module

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

Alkacon OpenCMS XSS via New User module

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

GHSA-Q693-V7QF-P4XJ Alkacon OpenCMS CSV Injection via New User module

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

Alkacon OpenCMS CSV Injection via New User module

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...