CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL-Execution vulnerability exploitable by authenticated administrators via the DatabaseQuery interface. Attackers can send crafted SQL in the qs parameter to /admin/DatabaseQuery to read sensitive data (e.g., usernames and password hashes from the OKM_USER ...

PT-2026-43254

Name of the Vulnerable Software and Affected Versions OpenKM version 6.3.12 Description Authenticated administrative users can execute arbitrary SQL statements against the application database through the DatabaseQuery interface. By submitting malicious SQL queries via the qs parameter to the...

CVE-2026-42425: Improper Neutralization of Special Elements used in an SQL Command

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...

📄 OpenKM Community Edition 6.3.10 Code Execution / LFI / SQL Injection

OpenKM Community Edition version 6.3.10 proof of concept Metasploit module that exploits local file inclusion, remote code execution, and SQL injection vulnerabilities...

CVE-2024-35475

A Cross-Site Request Forgery (CSRF) vulnerability exists in OpenKM Community Edition version 6.3.12 and earlier. The flaw is located in the /admin/DatabaseQuery endpoint, which allows an attacker to manipulate a victim with administrative privileges into executing arbitrary SQL commands . To reme...

CVE-2024-35475

A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...

PT-2024-26513

Name of the Vulnerable Software and Affected Versions OpenKM Community Edition versions 6.3.12 and earlier Description A Cross-Site Request Forgery CSRF issue was found in the "admin/DatabaseQuery" endpoint, allowing an attacker to manipulate a victim with administrative privileges into executing...

OpenKM security vulnerabilities

OpenKM is a document management system from the Spanish company OpenKM. The system provides features such as version control, document history and file sharing. A security vulnerability exists in OpenKM 6.3.12 and earlier versions, which stems from a cross-site request forgery CSRF vulnerability ...

CVE-2024-35475: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...