Opencms

This hub aggregates every CVE we track for Opencms, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Opencms.

• CVE-2023-42346Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.7.5May 8, 2026
• CVE-2023-42345A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.6.1May 8, 2026
• CVE-2023-42344Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.7.3May 8, 2026
• CVE-2023-42343A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.6.1May 8, 2026
• CVE-2026-2736Reflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms6.1Feb 19, 2026
• CVE-2026-2735Stored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms5.4Feb 19, 2026
• CVE-2025-28099opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp,4.3Apr 21, 2025
• CVE-2024-41446A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under th...5.4Apr 21, 2025
• CVE-2024-42699Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field6.5Apr 21, 2025
• CVE-2024-41447A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under t...5.4Apr 18, 2025
• CVE-2025-3317fumiao opencms dataPage.jsp path traversal4.3Apr 6, 2025
• CVE-2025-0708fumiao opencms Add Model Management Page addOrUpdate cross site scripting3.5Jan 24, 2025
• CVE-2024-5521Cross-Site Scripting stored in Alkacon OpenCMS6.4May 30, 2024
• CVE-2024-5520Cross-Site Scripting stored in Alkacon OpenCMS6.4May 30, 2024
• CVE-2023-6380Open Redirect in Alkacon Software OpenCms6.1Dec 13, 2023