# org.opencms:opencms-core (Maven) vulnerabilities 31 known vulnerabilities (2 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 22.0 (Oct 2, 2026): no advisory affects it - Newest unaffected release: 22.0 (Oct 2, 2026), the latest release - Dependents: 0 - Releases: 36 since 8.0.1 (Jan 5, 2012) - Registry: https://central.sonatype.com/artifact/org.opencms/opencms-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2023-42346: 8.0.1 to 15.0 (16.0 is outside it) - CVE-2023-42345: 8.0.1 to 15.0 (16.0 is outside it) - CVE-2023-42344: 8.0.1 to 10.5.0 (10.5.1 is outside it) - CVE-2023-42343: 8.0.1 to 15.0 (16.0 is outside it) - CVE-2024-42699: 8.0.1 to 17.0 (18.0 is outside it) - CVE-2024-41446: 8.0.1 to 17.0 (18.0 is outside it) - CVE-2024-41447: 8.0.1 to 17.0 (18.0 is outside it) - CVE-2024-5520: 16.0 (17.0 is outside it) - CVE-2023-6379: 14.0 to 15.0 (16.0 is outside it) - CVE-2023-37602: 8.0.1 to 15.0 (16.0 is outside it) - CVE-2023-31544: 8.0.1 to 11.0.0 (11.0.1 is outside it) - CVE-2021-3312: 11.0.0 to 11.0.2 (12.0 is outside it) - CVE-2019-13237: 8.0.1 to 11.0.0 (11.0.1 is outside it) - CVE-2019-13236: 8.0.1 to 11.0.0 (11.0.1 is outside it) - CVE-2019-13235: 8.0.1 to 11.0.0 (11.0.1 is outside it) - CVE-2019-13234: 8.0.1 to 11.0.0 (11.0.1 is outside it) - CVE-2019-11819: 8.0.1 to 10.5.4 (11.0.0 is outside it) - CVE-2019-11818: 8.0.1 to 10.5.4 (11.0.0 is outside it) - CVE-2015-2351: 8.0.1 to 9.5.1 (9.5.2 is outside it) - CVE-2013-4600: 8.0.1 to 8.5.1 (8.5.2 is outside it) - CVE-2008-1753: no published release is affected - CVE-2008-1510: no published release is affected - CVE-2008-1301: no published release is affected - CVE-2008-1300: no published release is affected - CVE-2008-1045: no published release is affected - CVE-2006-3936: no published release is affected - CVE-2006-3935: no published release is affected - CVE-2006-3934: no published release is affected - CVE-2006-3933: no published release is affected - CVE-2006-2571: no published release is affected - CVE-2005-4294: no published release is affected ## Advisories (31) ### [CVE-2023-42346](https://cve.now/CVE-2023-42346): Alkacon OpenCms before 16 allows XXE when the \ refers to an external host. - Severity: High 7.5 - Published: May 8, 2026 - Affected: fixed in 16.0. - Fixed in 16.0 (released Sep 29, 2023, 952 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2023-42345](https://cve.now/CVE-2023-42345): A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. - Severity: Medium 6.1 - Published: May 8, 2026 - Affected: fixed in 16.0. - Fixed in 16.0 (released Sep 29, 2023, 952 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2023-42344](https://cve.now/CVE-2023-42344): Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack… - Severity: High 7.3 - Published: May 8, 2026 - Affected: fixed in 10.5.1. - Fixed in 10.5.1 (released Feb 15, 2017, 3369 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2023-42343](https://cve.now/CVE-2023-42343): A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. - Severity: Medium 6.1 - Published: May 8, 2026 - Affected: fixed in 16.0. - Fixed in 16.0 (released Sep 29, 2023, 952 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2024-42699](https://cve.now/CVE-2024-42699): Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript… - Severity: Medium 6.5 - Published: Apr 21, 2025 - Affected: through 17.0. - Fixed in 18.0 (released Oct 7, 2024, 196 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 22.0, is not affected. ### [CVE-2024-41446](https://cve.now/CVE-2024-41446): A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a… - Severity: Medium 5.4 - Published: Apr 21, 2025 - Affected: through 17.0. - Fixed in 18.0 (released Oct 7, 2024, 196 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 22.0, is not affected. ### [CVE-2024-41447](https://cve.now/CVE-2024-41447): A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a… - Severity: Medium 5.4 - Published: Apr 18, 2025 - Affected: through 17.0. - Fixed in 18.0 (released Oct 7, 2024, 193 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 22.0, is not affected. ### [CVE-2024-5520](https://cve.now/CVE-2024-5520): Cross-Site Scripting stored in Alkacon OpenCMS - Severity: Medium 6.4 - Published: May 30, 2024 - Affected: from 16.0, fixed in 17.0. - Fixed in 17.0 (released Apr 8, 2024, 52 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2023-6379](https://cve.now/CVE-2023-6379): Cross-site Scripting in Alkacon Software OpenCms - Severity: Medium 5.4 - Published: Dec 13, 2023 - Affected: from 14.0.0, fixed in 16.0.0. - Fixed in 16.0 (released Sep 29, 2023, 75 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2023-37602](https://cve.now/CVE-2023-37602): An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute… - Severity: Unrated - Published: Jul 20, 2023 - Affected: through 15.0. - Fixed in 16.0 (released Sep 29, 2023, 71 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 22.0, is not affected. ### [CVE-2023-31544](https://cve.now/CVE-2023-31544): A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML… - Severity: Medium 5.4 - Published: May 16, 2023 - Affected: fixed in 11.0.1. - Fixed in 11.0.1 (released Sep 5, 2019, 1349 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2021-3312](https://cve.now/CVE-2021-3312): An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit… - Severity: Unrated - Published: Oct 8, 2021 - Affected: from 11.0.0, fixed in 12.0.0. - Fixed in 12.0 (released Oct 12, 2021, 4 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2019-13237](https://cve.now/CVE-2019-13237): In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access… - Severity: Unrated - Published: Aug 27, 2019 - Affected: fixed in 11.0.1. - Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2019-13236](https://cve.now/CVE-2019-13236): In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface. - Severity: Unrated - Published: Aug 27, 2019 - Affected: fixed in 11.0.1. - Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2019-13235](https://cve.now/CVE-2019-13235): In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form. - Severity: Unrated - Published: Aug 27, 2019 - Affected: fixed in 11.0.1. - Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2019-13234](https://cve.now/CVE-2019-13234): In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine. - Severity: Unrated - Published: Aug 27, 2019 - Affected: fixed in 11.0.1. - Fixed in 11.0.1 (released Sep 5, 2019, 9 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2019-11819](https://cve.now/CVE-2019-11819): Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User… - Severity: Unrated - Published: May 8, 2019 - Affected: fixed in 11.0.0. - Fixed in 11.0.0 (released May 22, 2019, 14 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2019-11818](https://cve.now/CVE-2019-11818): Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User… - Severity: Unrated - Published: May 8, 2019 - Affected: fixed in 11.0.0. - Fixed in 11.0.0 (released May 22, 2019, 14 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2015-2351](https://cve.now/CVE-2015-2351): Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web… - Severity: Unrated - Published: Mar 19, 2015 - Affected: fixed in 9.5.2. - Fixed in 9.5.2 (released Jun 23, 2015, 96 days after disclosure). - The latest release, 22.0, is not affected. ### [CVE-2013-4600](https://cve.now/CVE-2013-4600): Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script… - Severity: Unrated - Published: Aug 9, 2013 - Affected: fixed in 8.5.2. - Fixed in 8.5.2 (released Jul 21, 2013, 19 days before disclosure). - The latest release, 22.0, is not affected. ### [CVE-2008-1753](https://cve.now/CVE-2008-1753): Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers… - Severity: Unrated - Published: Apr 11, 2008 - Affected: fixed in 7.0.4. - Fixed in 8.0.1 (released Jan 5, 2012, 1364 days after disclosure, the advisory names 7.0.4, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2008-1510](https://cve.now/CVE-2008-1510): Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users\_list.jsp in Alkacon OpenCMS 7.0.3 allows remote… - Severity: Unrated - Published: Mar 25, 2008 - Affected: fixed in 7.0.4. - Fixed in 8.0.1 (released Jan 5, 2012, 1381 days after disclosure, the advisory names 7.0.4, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2008-1301](https://cve.now/CVE-2008-1301): Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and… - Severity: Unrated - Published: Mar 12, 2008 - Affected: from 7.0.3, fixed in 7.0.5. - Fixed in 8.0.1 (released Jan 5, 2012, 1394 days after disclosure, the advisory names 7.0.5, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2008-1300](https://cve.now/CVE-2008-1300): Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in… - Severity: Unrated - Published: Mar 12, 2008 - Affected: from 7.0.3, fixed in 7.0.5. - Fixed in 8.0.1 (released Jan 5, 2012, 1394 days after disclosure, the advisory names 7.0.5, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2008-1045](https://cve.now/CVE-2008-1045): Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree\_files.jsp in Alkacon… - Severity: Unrated - Published: Feb 27, 2008 - Affected: fixed in 7.0.4. - Fixed in 8.0.1 (released Jan 5, 2012, 1408 days after disclosure, the advisory names 7.0.4, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2006-3936](https://cve.now/CVE-2006-3936): system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary… - Severity: Unrated - Published: Jul 31, 2006 - Affected: fixed in 6.2.2. - Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2006-3935](https://cve.now/CVE-2006-3935): system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which… - Severity: Unrated - Published: Jul 31, 2006 - Affected: fixed in 6.2.2. - Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2006-3934](https://cve.now/CVE-2006-3934): Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download… - Severity: Unrated - Published: Jul 31, 2006 - Affected: fixed in 6.2.2. - Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2006-3933](https://cve.now/CVE-2006-3933): Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script… - Severity: Unrated - Published: Jul 31, 2006 - Affected: fixed in 6.2.2. - Fixed in 8.0.1 (released Jan 5, 2012, 1984 days after disclosure, the advisory names 6.2.2, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2006-2571](https://cve.now/CVE-2006-2571): Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject… - Severity: Unrated - Published: May 24, 2006 - Affected: from 6.0.0, fixed in 6.0.4. - Fixed in 8.0.1 (released Jan 5, 2012, 2052 days after disclosure, the advisory names 6.0.4, which was never published). - The latest release, 22.0, is not affected. ### [CVE-2005-4294](https://cve.now/CVE-2005-4294): Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML… - Severity: Unrated - Published: Dec 16, 2005 - Affected: fixed in 6.0.3. - Fixed in 8.0.1 (released Jan 5, 2012, 2211 days after disclosure, the advisory names 6.0.3, which was never published). - The latest release, 22.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.opencms:opencms-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.