Alfresco Share - Open Redirect

Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-14223 info: name:...

CVE-2019-14222

CVE-2019-14222: Default Certificate in Alfresco Community Alfresco Community 5.x and below ships by default with a set of known private certificates. Anyone who downloads and installs the Alfresco Community software on a local machine gets access to these files. Once obtained, these private keys...

CVE-2019-14223

CVE-2019-14223: Open Redirect in Alfresco Share The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulation the “failure” parameter an attacker can redirect a victim to a malicious website over any protocol the attacker desires E.g. http,...

CVE-2026-26336-PoC

CVE-2026-26336 — Lettura non autorizzata di file in Alfresco Share Panoramica Alfresco Share espone un endpoint /share/page/resource/ utilizzato per servire risorse statiche. Nelle versioni vulnerabili, questo endpoint non limita correttamente il path traversal, consentendo a un attaccante non...

burp-alfresco-referer-proxy-cve-2014-9301

burp-alfresco-referer-proxy-cve-2014-9301...

CVE-2019-14224

CVE-2019-14224: Authenticated Remote Code Execution in Alfresco Community By leveraging multiple components in the Alfresco Software applications, an exploit chain was observed that allows an attacker to achieve remote code execution. The attacker must use Alfresco to: Upload malicious Solr...

CVE-2023-49964

CVE-2023-49964: FreeMarker Server-Side Template Injection in Alfresco An issue was discovered in Hyland Alfresco Community Edition =7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage...

@alfresco/adf-testing (6.0.0-A.2-8258), @genexus/ngx-aws-deploy (5.2.1) +5 more potentially affected by CVE-2026-14257 via brace-expansion (>=2.0.0, <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-14257 Source advisory: OSV:GHSA-MH99-V99M-4GVG...

@alfresco/adf-testing (6.0.0-A.2-8258), @genexus/ngx-aws-deploy (5.2.1) +5 more potentially affected by CVE-2026-14257 via brace-expansion (>=2.0.0, <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-14257 Source advisory: SNYK:JS-BRACEEXPANSION-18313044...

@alfresco/adf-testing (6.0.0-A.2-8258), @genexus/ngx-aws-deploy (5.2.1) +5 more potentially affected by CVE-2026-13149 via brace-expansion (>=2.0.0, <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

Exploit for Incorrect Authorization in Hyland Alfresco_Content_Services

CVE-2026-26336 — Alfresco Share Unauthenticated File Read...

@alfresco/adf-testing (6.0.0-A.2-8258), @genexus/ngx-aws-deploy (5.2.1) +5 more potentially affected by CVE-2026-33750 via brace-expansion (>=2.0.0, <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-33750 Source advisory: SNYK:JS-BRACEEXPANSION-15789759...

CVE-2026-3967

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization...

EUVD-2026-11492

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization...

CVE-2026-3967

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization...

CVE-2026-3967 Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization...

CVE-2026-3967 Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization...

CVE-2026-3967

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization...

CVE-2026-3967

Alfresco Activiti up to versions 7.19/8.8.0 is affected by a deserialization flaw in the function deserialize/createObjectInputStream of activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java within the Process Variable Serialization System. This leads...

Alfresco Activiti 代码问题漏洞

Alfresco Activiti is a workflow automation platform developed by the British company Alfresco. Versions of Alfresco Activiti 7.19/8.8.0 and earlier contained code vulnerabilities. These vulnerabilities stemmed from an operation in the function deserialize/createObjectInputStream located in the fi...