Skip to content
Noroxi

Alkacon records

36 published records for vendor alkacon.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
63.9%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

36 records
  • CVE-2018-8811
    36Monitor

    Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers t

    HighCVSS 8.8Proof of conceptEPSS 2%

    alkacon · opencmsMar 20, 2018

  • CVE-2019-11819
    31Monitor

    Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/ac

    HighCVSS 7.8No exploitEPSS 1%

    alkacon · opencmsMay 8, 2019

  • CVE-2006-3935
    27Monitor

    system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allow

    MediumCVSS 6.5No exploitEPSS 2%

    alkacon · opencmsJul 31, 2006

  • CVE-2005-4475
    27Monitor

    Cross-site scripting (XSS) vulnerability in OpenCms 6.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via uns

    MediumCVSS 6.8No exploitEPSS 1%

    alkacon · opencmsDec 22, 2005

  • CVE-2021-3312
    26Monitor

    An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges

    MediumCVSS 6.5No exploitEPSS 1%

    alkacon · opencmsOct 8, 2021

  • CVE-2024-42699
    26Monitor

    Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript pay

    MediumCVSS 6.5No exploitEPSS 0%

    alkacon · opencmsApr 21, 2025

  • CVE-2019-13236
    25Monitor

    In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.

    MediumCVSS 6.1Proof of conceptEPSS 3%

    alkacon · opencmsAug 27, 2019

  • CVE-2019-13234
    25Monitor

    In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.

    MediumCVSS 6.1Proof of conceptEPSS 3%

    alkacon · opencms apollo templateAug 27, 2019

  • CVE-2019-13235
    25Monitor

    In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.

    MediumCVSS 6.1Proof of conceptEPSS 3%

    alkacon · opencms apollo templateAug 27, 2019

  • CVE-2023-6379
    25Monitor

    Cross-site Scripting in Alkacon Software OpenCms

    MediumCVSS 6.1Proof of conceptEPSS 2%

    alkacon · opencmsDec 13, 2023

  • CVE-2024-5521
    25Monitor

    Cross-Site Scripting stored in Alkacon OpenCMS

    MediumCVSS 6.4No exploitEPSS 0%

    alkacon · opencmsMay 30, 2024

  • CVE-2023-6380
    24Monitor

    Open Redirect in Alkacon Software OpenCms

    MediumCVSS 6.1Proof of conceptEPSS 2%

    alkacon · opencmsDec 13, 2023

  • CVE-2019-11818
    24Monitor

    Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/

    MediumCVSS 6.1No exploitEPSS 1%

    alkacon · opencmsMay 8, 2019

  • CVE-2023-37602
    24Monitor

    An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary

    MediumCVSS 6.1No exploitEPSS 1%

    alkacon · opencmsJul 20, 2023

  • CVE-2021-25968
    21Monitor

    OpenCMS - Stored Cross-Site Scripting (XSS) in Sitemap

    MediumCVSS 5.4No exploitEPSS 1%

    alkacon · opencmsOct 19, 2021

  • CVE-2023-31544
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via

    MediumCVSS 5.4No exploitEPSS 0%

    alkacon · opencmsMay 16, 2023

  • CVE-2024-5520
    21Monitor

    Cross-Site Scripting stored in Alkacon OpenCMS

    MediumCVSS 5.4No exploitEPSS 0%

    alkacon · opencmsMay 30, 2024

  • CVE-2024-41446
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a c

    MediumCVSS 5.4No exploitEPSS 0%

    alkacon · opencmsApr 21, 2025

  • CVE-2024-41447
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a c

    MediumCVSS 5.4No exploitEPSS 0%

    alkacon · opencmsApr 18, 2025

  • CVE-2026-2736
    20Monitor

    Reflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms

    MediumCVSS 5.1No exploitEPSS 0%

    alkacon · opencmsFeb 19, 2026

  • CVE-2026-2735
    20Monitor

    Stored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms

    MediumCVSS 5.1No exploitEPSS 0%

    alkacon · opencmsFeb 19, 2026

  • CVE-2019-13237
    19Monitor

    In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access serve

    MediumCVSS 4.3Proof of conceptEPSS 7%

    alkacon · opencms apollo templateAug 27, 2019

  • CVE-2015-2351
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web scri

    MediumCVSS 4.3No exploitEPSS 2%

    alkacon · opencmsMar 19, 2015

  • CVE-2013-4600
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or

    MediumCVSS 4.3No exploitEPSS 2%

    alkacon · opencmsAug 9, 2013

  • CVE-2018-8815
    18Monitor

    Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web s

    MediumCVSS 4.6Proof of conceptEPSS 1%

    alkacon · opencmsMar 20, 2018