CVE-2022-40317

CVE-2022-40317 XSS memorizzato nelle note Un XSS memorizzato è stato trovato nella sezione delle note dell'applicazione durante un test di penetrazione su un cliente che utilizzava OpenKM. In pratica, quando si salvavano le note, in qualche modo veniva consentito HTML normale che veniva...

CVE-2025-57244

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...

EUVD-2025-37895

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...

EUVD-2024-35341

Malicious code in bioql PyPI...

CVE-2024-35475

A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...

CVE-2024-35475

A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...

CVE-2024-35475

OpenKM Community Edition versions 6.3.12 and earlier are affected by CVE-2024-35475, a CSRF vulnerability in the /admin/DatabaseQuery endpoint. The issue allows an attacker with administrative privileges to instruct the victim to execute arbitrary SQL commands. Impact is described as potential ma...

PT-2022-14948 · Openkm · Openkm Community Edition

Name of the Vulnerable Software and Affected Versions: OpenKM Community Edition versions 6.3.10 and earlier Description: The issue allows an attacker to perform an XML external entity injection attack due to the use of the XMLReader parser in the XMLTextExtractor.java file without the required...

CVE-2021-3628

OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting XSS. A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter...

CVE-2021-3628

OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting XSS. A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter...