CVE-2019-11819: Improper Neutralization of Formula Elements in a CSV File

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

PT-2019-12505

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before Description The issue concerns stored cross-site scripting XSS in the New User module, specifically at the "/opencms/system/workplace/admin/accounts/user new.jsp" endpoint. An attacker can insert...

PT-2019-12506

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before Description The issue concerns CSV aka Excel Macro Injection in the New User module, specifically through the "First Name" or "Last Name" fields in the /opencms/system/workplace/admin/accounts/user...

OpenCMS 10.5.3 - Cross-Site Scripting

OpenCMS 10.5.3 - Cross-Site Scripting Exploit Title: OpenCMS 10.5.3 Stored Cross Site Scripting Vulnerability Google Dork: N/A Date: 02-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.opencms.org/en/ Software Link:...

OpenCMS 10.5.3 - Cross-Site Scripting

Exploit Title: OpenCMS 10.5.3 Stored Cross Site Scripting Vulnerability Google Dork: N/A Date: 02-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.opencms.org/en/ Software Link:...

Alkacon OpenCms Cross-Site Request Forgery Vulnerability

Alkacon OpenCms is the German Alkacon Software's set of open source Java and XML-based content management system CMS. The system supports template engine , WYSIWYG editor and so on. A cross-site request forgery vulnerability exists in the system/workplace/admin/accounts/userrole.jsp file in Alkac...

Alkacon OpenCMS gallery feature cross-site scripting vulnerability

Alkacon OpenCms is the German Alkacon Software's set of open source Java and XML-based content management system CMS. The system supports template engine , WYSIWYG editor and so on. A cross-site scripting vulnerability exists in the gallery feature in Alkacon OpenCMS version 10.5.3. A remote...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

Cross site scripting

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

CVE-2018-8815

CVE-2018-8815 concerns Alkacon OpenCMS 10.5.3 where the gallery feature is vulnerable to cross-site scripting (XSS). A remote attacker can inject arbitrary web script or HTML by supplying a malicious SVG image, due to an underlying issue in the gallery function. The available sources confirm the ...

CVE-2018-8815: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

PT-2018-18639

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS version 10.5.3 Description A cross-site scripting XSS issue exists in the gallery function, allowing remote attackers to inject arbitrary web script or HTML via a malicious SVG image. This can be exploited by attackers to execu...

CVE-2015-2351

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...

CVE-2015-2351

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...

CVE-2015-2351

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...

CVE-2015-2351: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...