218 matches found
CVE-2023-50072
CVE-2023-50072 A stored cross-site scripting XSS vulnerability exists in OpenKM version 7.1.40 dbb6e88 With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS...
CVE-2026-112182
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints registerProcessDefinition and runProcessDefinition require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the ROLEUSER role c...
CVE-2026-112182
OpenKM Community Edition contains an authorization vulnerability within its workflow definition management. The REST endpoints registerProcessDefinition and runProcessDefinition authenticate users but fail to verify roles in the WorkflowService or underlying layers. Consequently, an attacker with...
EUVD-2026-125271
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints registerProcessDefinition and runProcessDefinition require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the ROLEUSER role c...
CVE-2026-112182 Multiple Vulnerabilities in OpenKM Community Edition
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints registerProcessDefinition and runProcessDefinition require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the ROLEUSER role c...
CVE-2026-112181
The OpenKM Community Edition software is vulnerable to an XML External Entity (XXE) flaw due to inadequate restriction of external references in the FormUtils / LocalEntityResolver component. An authenticated remote attacker with the ROLE_USER role can exploit this via a REST request. In the 6.3....
CVE-2026-112181 Multiple Vulnerabilities in OpenKM Community Edition
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLEUSER role can exploi...
EUVD-2026-125270
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLEUSER role can exploi...
CVE-2026-30503-OpenKM-6.3.12-Stored-XSS
🛡️ CVE-2026-30503 — Stored XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar — Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure 📌 Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...
CVE-2026-30502-OpenKM-6.3.12-Reflected-XSS
🛡️ CVE-2026-30502 — Reflected XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar — Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure 📌 Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...
CVE-2022-40317
CVE-2022-40317 Stored XSS in Notes A stored XSS was found in the notes section of the application while we were pentesting a client that was using OpenKM. Basically, when storing notes, somehow normal HTML was allowed and it was rendered as is. As you know, However, we found that using...
PT-2026-49623
Happy to share that I recently discovered and responsibly reported security vulnerabilities in OpenKM Document Management System v6.3.12. These issues have now been assigned the following CVE IDs: CVE-2026-30502 CVE-2026-30503 CyberSecurity CVE SecurityResearch dharmstm https://t.co/Zge3oCAHeT...
PT-2026-49624
Happy to share that I recently discovered and responsibly reported security vulnerabilities in OpenKM Document Management System v6.3.12. These issues have now been assigned the following CVE IDs: CVE-2026-30502 CVE-2026-30503 CyberSecurity CVE SecurityResearch dharmstm https://t.co/Zge3oCAHeT...
CVE-2026-42785
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...
CVE-2026-42425
OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...
CVE-2026-41917
OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...
CVE-2026-42785
OpenKM 6.3.12 is affected by a remote code execution vulnerability exploitable by authenticated administrators via the /admin/Scripting endpoint. The issue allows submission of malicious script content with an action=Evaluate parameter to execute arbitrary Java/BeanShell code in the OpenKM applic...
CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...
CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...
CVE-2026-42785
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...