CVE-2024-42699

Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field...

Alkacon OpenCMS security vulnerabilities

Alkacon OpenCMS is a content management system from Alkacon Inc. A security vulnerability exists in Alkacon OpenCMS version 17.0, which stems from the presence of stored cross-site scripting in the image parameter of the Create/Modify article function, which could lead to the execution of arbitra...

Alkacon OpenCMS security vulnerabilities

Alkacon OpenCMS is a content management system from Alkacon Inc. A security vulnerability exists in Alkacon OpenCMS version 17.0, which stems from cross-site scripting in the title subfield of the image field in the Create/Modify article function, which could lead to the injection of a javascript...

CVE-2024-42699

Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field...

CVE-2025-28099

opencms V2.3 is vulnerable to an Arbitrary file read flaw located in the src/main/webapp/view/admin/document/dataPage.jsp file. The root cause is characterized as an Improper Limitation of a Pathname to a Restricted Directory (CWE-22 ). This vulnerability allows an attacker to read files on the s...

CVE-2024-41446

Alkacon OpenCMS v17.0 is susceptible to a stored cross-site scripting (XSS) vulnerability. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the image parameter within the Create/Modify article function. As a mitigation, it is recommended to disable the Creat...

CVE-2024-41446

A stored cross-site scripting XSS vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function...

CVE-2024-42699

The Alkacon OpenCMS content management system is vulnerable to Cross-Site Scripting (XSS) in the Create/Modify article function. Specifically, the org.opencms:opencms-core component (versions >=8.0.1 and

PT-2025-17444 · Alkacon · Alkacon Opencms

Name of the Vulnerable Software and Affected Versions: Alkacon OpenCMS version 17.0 Description: A Cross Site Scripting vulnerability in the Create/Modify article function allows a remote attacker to inject a javascript payload via the image title sub-field in the image field. Recommendations: Fo...

OpenCMS security vulnerabilities

opencms is a CMS system of fumiao individual developer. A security vulnerability exists in opencms V2.3, which originates from the file src/main/webapp/view/admin/document/dataPage.jsp being read by an arbitrary file...

PT-2025-17435

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS version 17.0 Description A stored cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function...

PT-2025-17452 · Opencms · Opencms

Name of the Vulnerable Software and Affected Versions: opencms version 2.3 Description: The issue allows for Arbitrary file read in the src/main/webapp/view/admin/document/dataPage.jsp file. Recommendations: For opencms version 2.3, as a temporary workaround, consider restricting access to the...

CVE-2025-28099

opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp,...

org.opencms.modules:com.alkacon.opencms.v8.event (>=8.5.0, <=8.5.1), org.opencms.modules:com.alkacon.opencms.v8.flexible (>=8.5.0, <=8.5.1) +63 more potentially affected by CVE-2024-41447 via org.opencms:opencms-core (8.5.0)

org.opencms:opencms-core MAVEN version 8.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms.modules:com.alkacon.opencms.v8.event =8.5.0, =8.5.0, =8.5.0, =8.5.0, =8.0.2.1, =8.5.0, =8.5.0,...

de.eonas.portal.demo:content (0.1), de.eonas.portal.demo:templates (0.1) +2 more potentially affected by CVE-2024-41447 via org.opencms:opencms-core (8.0.3.1)

org.opencms:opencms-core MAVEN version 8.0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - de.eonas.portal.demo:content 0.1 - de.eonas.portal.demo:templates 0.1 -...

org.opencms:opencms-webapp (8.0.2) potentially affected by CVE-2024-41447 via org.opencms:opencms-core (8.0.2)

org.opencms:opencms-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-webapp 8.0.2 Source cves: CVE-2024-41447 Source advisory: OSV:GHSA-VQ95-6X79-QV8J...

org.opencms.modules:com.alkacon.opencms.v8.article (>=8.0.1, <=8.0.4), org.opencms.modules:com.alkacon.opencms.v8.event (>=8.0.1, <=8.0.3) +65 more potentially affected by CVE-2024-41447 via org.opencms:opencms-core (8.0.1)

org.opencms:opencms-core MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms.modules:com.alkacon.opencms.v8.article =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1,...

Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability

A stored cross-site scripting XSS vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function...

org.opencms:opencms-components (9.0.1), org.opencms:opencms-gwt (9.0.1) +19 more potentially affected by CVE-2024-41447 via org.opencms:opencms-core (9.0.1)

org.opencms:opencms-core MAVEN version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-components 9.0.1 - org.opencms:opencms-gwt 9.0.1 - org.opencms:opencms-setup 9.0.1 -...

de.eonas.portal.demo:content (0.1), de.eonas.portal.demo:templates (0.1) +107 more potentially affected by CVE-2024-41447 via org.opencms:opencms-core (>=8.0.1, <=9.5.3)

org.opencms:opencms-core MAVEN version =8.0.1, =8.5.1.1, =8.5.1.1, =8.0.1, =8.0.1, =8.0.4, =8.5.0, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.5.0, =8.5.2 and more Source cves: CVE-2024-41447 Source advisory: SNYK:JAVA-ORGOPENCMS-9802336...