CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 1CVE-2023-31544
https://notcve.org/view.php?id=CVE-2023-31544
A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module. • https://github.com/alkacon/opencms-core/commit/21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e https://github.com/alkacon/opencms-core/issues/652 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25968 – OpenCMS - Stored Cross-Site Scripting (XSS) in Sitemap
https://notcve.org/view.php?id=CVE-2021-25968
In “OpenCMS”, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. En "OpenCMS", versiones 10.5.0 a 11.0.2, están afectadas por una vulnerabilidad de tipo XSS almacenado que permite a usuarios de aplicaciones poco privilegiado almacenar scripts maliciosos en la funcionalidad Sitemap. Estos scripts se ejecutan en el navegador de la víctima cuando ésta abre la página que contiene el campo vulnerable • https://github.com/alkacon/mercury-template/commit/800945f5d02346c633c7aef9f5d596d7dedc8fb5 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25968 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2021-3312
https://notcve.org/view.php?id=CVE-2021-3312
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document. Una vulnerabilidad de tipo XML external entity (XXE) en Alkacon OpenCms versiones 11.0, 11.0.1 y 11.0.2, permite a usuarios remotos autenticados con privilegios de edición exfiltrar archivos del sistema de archivos del servidor al cargar un documento SVG diseñado • https://github.com/alkacon/opencms-core/issues/725 https://github.com/alkacon/opencms-core/releases • CWE-611: Improper Restriction of XML External Entity Reference •