Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp

A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp...

GHSA-2887-F3V6-6RJF Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp

A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp...

CVE-2023-42345

A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp...

CVE-2026-30269

Doorman versions v0.1.0 and v1.0.2 are vulnerable to an improper access control flaw. The vulnerability exists because the role field is accepted by the update model at the /platform/user/{username} endpoint without a manage_users permission check for self-updates. This allows any authenticated u...