Lucene search
+L

172 matches found

Kitploit
Kitploit
added 2026/09/13 12:05 p.m.5 views

CVE-2022-40317

CVE-2022-40317 XSS almacenado en Notas Se encontró un XSS almacenado en la sección de notas de la aplicación mientras pentesteábamos un cliente que usaba OpenKM. Básicamente, al almacenar notas, de alguna manera se permitía HTML normal y se renderizaba tal cual. Como saben, las etiquetas Sin...

5.4CVSS6AI score0.01089EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/13 11:44 a.m.8 views

CVE-2023-50072

CVE-2023-50072 Existe una vulnerabilidad de cross-site scripting XSS almacenado en OpenKM versión 7.1.40 dbb6e88 con Extensión Profesional que permite a un usuario autenticado cargar una nota en un archivo que actúa como un payload XSS almacenado. Cualquier usuario que abra la nota de un archivo ...

5.4CVSS6.7AI score0.00618EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/13 10:53 a.m.8 views

CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — XSS Almacenado en OpenKM v6.3.12 Descubierto y reportado porDharmendra Kumar — Investigador de Seguridad Ciberseguridad | Pruebas de Penetración | Investigación de Vulnerabilidades | Divulgación Responsable 📌 Tabla de Contenidos Resumen Detalles del CVE Producto Afectado...

5.8AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/13 10:53 a.m.8 views

CVE-2026-30502-OpenKM-6.3.12-Reflected-XSS

🛡️ CVE-2026-30502 — XSS Reflejado en OpenKM v6.3.12 Descubierto e informado porDharmendra Kumar — Investigador de Seguridad Ciberseguridad | Pruebas de Penetración | Investigación de Vulnerabilidades | Divulgación Responsable 📌 Tabla de Contenidos Resumen Detalles del CVE Producto Afectado...

5.9AI score
SaveExploits0References1
NVD
NVD
added 2026/05/26 3:16 p.m.31 views

CVE-2026-42785

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

8.6CVSS0.00679EPSS
SaveExploits0References7
NVD
NVD
added 2026/05/26 3:16 p.m.19 views

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

8.6CVSS0.00641EPSS
SaveExploits0References7
NVD
NVD
added 2026/05/26 3:16 p.m.41 views

CVE-2026-41917

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

6.9CVSS0.00387EPSS
SaveExploits0References7
CVE
CVE
added 2026/05/26 2:08 p.m.79 views

CVE-2026-42785

OpenKM 6.3.12 is affected by a remote code execution vulnerability exploitable by authenticated administrators via the /admin/Scripting endpoint. The issue allows submission of malicious script content with an action=Evaluate parameter to execute arbitrary Java/BeanShell code in the OpenKM applic...

8.6CVSS6.6AI score0.00679EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
added 2026/05/26 2:08 p.m.11 views

CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

8.6CVSS6.6AI score0.00679EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/05/26 2:08 p.m.59 views

CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

8.6CVSS0.00679EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2026/05/26 2:08 p.m.14 views

CVE-2026-42785

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

8.6CVSS6.6AI score0.00679EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/05/26 2:08 p.m.33 views

EUVD-2026-31835

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

8.6CVSS6.6AI score0.00679EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/05/26 2:08 p.m.66 views

CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

8.6CVSS0.00641EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
added 2026/05/26 2:08 p.m.15 views

CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

8.6CVSS6.2AI score0.00641EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2026/05/26 2:08 p.m.17 views

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

8.6CVSS6.2AI score0.00641EPSS
SaveExploits0References7
CVE
CVE
added 2026/05/26 2:08 p.m.44 views

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL-Execution vulnerability exploitable by authenticated administrators via the DatabaseQuery interface. Attackers can send crafted SQL in the qs parameter to /admin/DatabaseQuery to read sensitive data (e.g., usernames and password hashes from the OKM_USER ...

8.6CVSS6.2AI score0.00641EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
added 2026/05/26 2:08 p.m.20 views

CVE-2026-41917 OpenKM 6.3.12 Local File Inclusion via Admin Scripting

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

6.9CVSS5.9AI score0.00387EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/05/26 2:08 p.m.67 views

CVE-2026-41917 OpenKM 6.3.12 Local File Inclusion via Admin Scripting

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

6.9CVSS0.00387EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2026/05/26 2:08 p.m.21 views

CVE-2026-41917

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

6.9CVSS5.9AI score0.00387EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/05/26 2:08 p.m.18 views

EUVD-2026-31833

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

6.9CVSS5.9AI score0.00387EPSS
SaveExploits0References7
Rows per page
Query Builder