Code injection

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

CVE-2019-11819

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

CVE-2019-11818

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

CVE-2019-11819

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

CVE-2019-11818

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

CVE-2019-11819

CVE-2019-11819 affects Alkacon OpenCMS v10.5.4 and earlier. The vulnerability is a CSV (Excel Macro) Injection in the New User module (path: /opencms/system/workplace/admin/accounts/user_new.jsp) triggered via the First Name or Last Name fields. The connected documents confirm the same issue acro...

CVE-2019-11819

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

CVE-2019-11818

CVE-2019-11818 affects Alkacon OpenCMS v10.5.4 and earlier. The stored XSS vulnerability resides in the New User module (opencms/system/workplace/admin/accounts/user_new.jsp), allowing attackers to inject arbitrary JavaScript via First Name or Last Name fields; the payload is executed when the af...

CVE-2019-11818

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

CVE-2019-11818

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

PT-2019-12506

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before Description The issue concerns CSV aka Excel Macro Injection in the New User module, specifically through the "First Name" or "Last Name" fields in the /opencms/system/workplace/admin/accounts/user...

PT-2019-12505

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before Description The issue concerns stored cross-site scripting XSS in the New User module, specifically at the "/opencms/system/workplace/admin/accounts/user new.jsp" endpoint. An attacker can insert...

CVE-2019-11819: Improper Neutralization of Formula Elements in a CSV File

Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...

CVE-2019-11818: Improper Neutralization of Input During Web Page Generation

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

de.eonas.portal:opencmsinstaller (>=9.0.0.1, <=9.5.2.0), de.eonas.portal:opencmsportaldriver (>=9.5.1.0, <=9.5.2.0) +22 more potentially affected by CVE-2017-3163 via org.apache.solr:solr-core (4.3.0)

org.apache.solr:solr-core MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - de.eonas.portal:opencmsinstaller =9.0.0.1, =9.5.1.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.0,...

opencms.org XSS vulnerability

Open Bug Bounty ID: OBB-662005 Description| Value ---|--- Affected Website:| opencms.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

OpenCMS 10.5.3 - Cross-Site Scripting

OpenCMS 10.5.3 - Cross-Site Scripting Exploit Title: OpenCMS 10.5.3 Stored Cross Site Scripting Vulnerability Google Dork: N/A Date: 02-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.opencms.org/en/ Software Link:...

OpenCMS 10.5.3 - Cross-Site Request Forgery

Exploit Title: OpenCMS 10.5.3 Multiple Cross Site Request Forgery Vulnerabilities Injection Google Dork: N/A Date: 02-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.opencms.org/en/ Software Link:...

OpenCMS 10.5.3 - Cross-Site Scripting

Exploit Title: OpenCMS 10.5.3 Stored Cross Site Scripting Vulnerability Google Dork: N/A Date: 02-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.opencms.org/en/ Software Link:...

OpenCMS 10.5.3 - Cross-Site Request Forgery

OpenCMS 10.5.3 - Cross-Site Request Forgery Exploit Title: OpenCMS 10.5.3 Multiple Cross Site Request Forgery Vulnerabilities Injection Google Dork: N/A Date: 02-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.opencms.org/en/ Software Link...