MavenPackage

org.opencms:opencms-core

31 known vulnerabilities (2 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release: 22.0 (Oct 2, 2026): no advisory affects it
Newest unaffected release: 22.0 (Oct 2, 2026), the latest release
Advisories: 31 · 2 high, 8 medium

Dependents: 0
Releases: 36 since 8.0.1 (Jan 5, 2012)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2023-42346
Affects 8.0.1 to 15.0 (16.0 is outside it)
CVE-2023-42345
Affects 8.0.1 to 15.0 (16.0 is outside it)
CVE-2023-42344
Affects 8.0.1 to 10.5.0 (10.5.1 is outside it)
CVE-2023-42343
Affects 8.0.1 to 15.0 (16.0 is outside it)
CVE-2024-42699
Affects 8.0.1 to 17.0 (18.0 is outside it)
CVE-2024-41446
Affects 8.0.1 to 17.0 (18.0 is outside it)
CVE-2024-41447
Affects 8.0.1 to 17.0 (18.0 is outside it)
CVE-2024-5520
Affects 16.0 (17.0 is outside it)
CVE-2023-6379
Affects 14.0 to 15.0 (16.0 is outside it)
CVE-2023-37602
Affects 8.0.1 to 15.0 (16.0 is outside it)
CVE-2023-31544
Affects 8.0.1 to 11.0.0 (11.0.1 is outside it)
CVE-2021-3312
Affects 11.0.0 to 11.0.2 (12.0 is outside it)

Show all 31 advisoriesShow fewer advisories

CVE-2019-13237
Affects 8.0.1 to 11.0.0 (11.0.1 is outside it)
CVE-2019-13236
Affects 8.0.1 to 11.0.0 (11.0.1 is outside it)
CVE-2019-13235
Affects 8.0.1 to 11.0.0 (11.0.1 is outside it)
CVE-2019-13234
Affects 8.0.1 to 11.0.0 (11.0.1 is outside it)
CVE-2019-11819
Affects 8.0.1 to 10.5.4 (11.0.0 is outside it)
CVE-2019-11818
Affects 8.0.1 to 10.5.4 (11.0.0 is outside it)
CVE-2015-2351
Affects 8.0.1 to 9.5.1 (9.5.2 is outside it)
CVE-2013-4600
Affects 8.0.1 to 8.5.1 (8.5.2 is outside it)
CVE-2008-1753
No published release is affected
No published release is affected
CVE-2008-1510
No published release is affected
No published release is affected
CVE-2008-1301
No published release is affected
No published release is affected
CVE-2008-1300
No published release is affected
No published release is affected
CVE-2008-1045
No published release is affected
No published release is affected
CVE-2006-3936
No published release is affected
No published release is affected
CVE-2006-3935
No published release is affected
No published release is affected
CVE-2006-3934
No published release is affected
No published release is affected
CVE-2006-3933
No published release is affected
No published release is affected
CVE-2006-2571
No published release is affected
No published release is affected
CVE-2005-4294
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 31

CVE-2023-42346High 7.5
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
Affected: fixed in 16.0.
Fixed in 16.0 (released Sep 29, 2023, 952 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2023-42345Medium 6.1
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
Affected: fixed in 16.0.
Fixed in 16.0 (released Sep 29, 2023, 952 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2023-42344High 7.3
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack…
Affected: fixed in 10.5.1.
Fixed in 10.5.1 (released Feb 15, 2017, 3369 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2023-42343Medium 6.1
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
Affected: fixed in 16.0.
Fixed in 16.0 (released Sep 29, 2023, 952 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2024-42699Medium 6.5
Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript…
Affected: through 17.0.
Fixed in 18.0 (released Oct 7, 2024, 196 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 22.0, is not affected.
CVE-2024-41446Medium 5.4
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a…
Affected: through 17.0.
Fixed in 18.0 (released Oct 7, 2024, 196 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 22.0, is not affected.
CVE-2024-41447Medium 5.4
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a…
Affected: through 17.0.
Fixed in 18.0 (released Oct 7, 2024, 193 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 22.0, is not affected.
CVE-2024-5520Medium 6.4
Cross-Site Scripting stored in Alkacon OpenCMS
Affected: from 16.0, fixed in 17.0.
Fixed in 17.0 (released Apr 8, 2024, 52 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2023-6379Medium 5.4
Cross-site Scripting in Alkacon Software OpenCms
Affected: from 14.0.0, fixed in 16.0.0.
Fixed in 16.0 (released Sep 29, 2023, 75 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2023-37602Unrated
An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute…
Affected: through 15.0.
Fixed in 16.0 (released Sep 29, 2023, 71 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 22.0, is not affected.
CVE-2023-31544Medium 5.4
A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML…
Affected: fixed in 11.0.1.
Fixed in 11.0.1 (released Sep 5, 2019, 1349 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2021-3312Unrated
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit…
Affected: from 11.0.0, fixed in 12.0.0.
Fixed in 12.0 (released Oct 12, 2021, 4 days after disclosure).
The latest release, 22.0, is not affected.
CVE-2019-13237Unrated
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access…
Affected: fixed in 11.0.1.
Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure).
The latest release, 22.0, is not affected.
CVE-2019-13236Unrated
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
Affected: fixed in 11.0.1.
Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure).
The latest release, 22.0, is not affected.
CVE-2019-13235Unrated
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
Affected: fixed in 11.0.1.
Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure).
The latest release, 22.0, is not affected.

Show all 31 advisoriesShow fewer advisories

CVE-2019-13234Unrated
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
Affected: fixed in 11.0.1.
Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure).
The latest release, 22.0, is not affected.
CVE-2019-11819Unrated
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User…
Affected: fixed in 11.0.0.
Fixed in 11.0.0 (released May 22, 2019, 14 days after disclosure).
The latest release, 22.0, is not affected.
CVE-2019-11818Unrated
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User…
Affected: fixed in 11.0.0.
Fixed in 11.0.0 (released May 22, 2019, 14 days after disclosure).
The latest release, 22.0, is not affected.
CVE-2015-2351Unrated
Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web…
Affected: fixed in 9.5.2.
Fixed in 9.5.2 (released Jun 23, 2015, 96 days after disclosure).
The latest release, 22.0, is not affected.
CVE-2013-4600Unrated
Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script…
Affected: fixed in 8.5.2.
Fixed in 8.5.2 (released Jul 21, 2013, 19 days before disclosure).
The latest release, 22.0, is not affected.
CVE-2008-1753Unrated
Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers…
Affected: fixed in 7.0.4.
Fixed in 8.0.1 (released Jan 5, 2012, 1364 days after disclosure, the advisory names 7.0.4, which was never published).
The latest release, 22.0, is not affected.
CVE-2008-1510Unrated
Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote…
Affected: fixed in 7.0.4.
Fixed in 8.0.1 (released Jan 5, 2012, 1381 days after disclosure, the advisory names 7.0.4, which was never published).
The latest release, 22.0, is not affected.
CVE-2008-1301Unrated
Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and…
Affected: from 7.0.3, fixed in 7.0.5.
Fixed in 8.0.1 (released Jan 5, 2012, 1394 days after disclosure, the advisory names 7.0.5, which was never published).
The latest release, 22.0, is not affected.
CVE-2008-1300Unrated
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in…
Affected: from 7.0.3, fixed in 7.0.5.
Fixed in 8.0.1 (released Jan 5, 2012, 1394 days after disclosure, the advisory names 7.0.5, which was never published).
The latest release, 22.0, is not affected.
CVE-2008-1045Unrated
Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon…
Affected: fixed in 7.0.4.
Fixed in 8.0.1 (released Jan 5, 2012, 1408 days after disclosure, the advisory names 7.0.4, which was never published).
The latest release, 22.0, is not affected.
CVE-2006-3936Unrated
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary…
Affected: fixed in 6.2.2.
Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published).
The latest release, 22.0, is not affected.
CVE-2006-3935Unrated
system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which…
Affected: fixed in 6.2.2.
Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published).
The latest release, 22.0, is not affected.
CVE-2006-3934Unrated
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download…
Affected: fixed in 6.2.2.
Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published).
The latest release, 22.0, is not affected.
CVE-2006-3933Unrated
Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script…
Affected: fixed in 6.2.2.
Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published).
The latest release, 22.0, is not affected.
CVE-2006-2571Unrated
Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject…
Affected: from 6.0.0, fixed in 6.0.4.
Fixed in 8.0.1 (released Jan 5, 2012, 2052 days after disclosure, the advisory names 6.0.4, which was never published).
The latest release, 22.0, is not affected.
CVE-2005-4294Unrated
Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML…
Affected: fixed in 6.0.3.
Fixed in 8.0.1 (released Jan 5, 2012, 2211 days after disclosure, the advisory names 6.0.3, which was never published).
The latest release, 22.0, is not affected.