CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — Stored XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar — Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure 📌 Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...

CVE-2026-30502-OpenKM-6.3.12-Reflected-XSS

🛡️ CVE-2026-30502 — Reflected XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar — Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure 📌 Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...

CVE-2022-40317

CVE-2022-40317 Stored XSS in Notes A stored XSS was found in the notes section of the application while we were pentesting a client that was using OpenKM. Basically, when storing notes, somehow normal HTML was allowed and it was rendered as is. As you know, However, we found that using...

CVE-2023-50072

CVE-2023-50072 A stored cross-site scripting XSS vulnerability exists in OpenKM version 7.1.40 dbb6e88 With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS...

PT-2026-49624

Happy to share that I recently discovered and responsibly reported security vulnerabilities in OpenKM Document Management System v6.3.12. These issues have now been assigned the following CVE IDs: CVE-2026-30502 CVE-2026-30503 CyberSecurity CVE SecurityResearch dharmstm https://t.co/Zge3oCAHeT...

PT-2026-49623

Happy to share that I recently discovered and responsibly reported security vulnerabilities in OpenKM Document Management System v6.3.12. These issues have now been assigned the following CVE IDs: CVE-2026-30502 CVE-2026-30503 CyberSecurity CVE SecurityResearch dharmstm https://t.co/Zge3oCAHeT...

CVE-2026-42785

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-41917

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

EUVD-2026-31835

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

CVE-2026-42785

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

CVE-2026-42785

OpenKM 6.3.12 is affected by a remote code execution vulnerability exploitable by authenticated administrators via the /admin/Scripting endpoint. The issue allows submission of malicious script content with an action=Evaluate parameter to execute arbitrary Java/BeanShell code in the OpenKM applic...

CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL-Execution vulnerability exploitable by authenticated administrators via the DatabaseQuery interface. Attackers can send crafted SQL in the qs parameter to /admin/DatabaseQuery to read sensitive data (e.g., usernames and password hashes from the OKM_USER ...

CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-41917 OpenKM 6.3.12 Local File Inclusion via Admin Scripting

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

EUVD-2026-31833

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...