All packages
OpenCms vulnerabilities
3 known CVE vulnerabilities in OpenCms, translated and rated.
- CVE-2026-38429Critical
OpenCMS version 20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user-supplied .zip files containing a manifest.xml.
- CVE-2023-42345Medium
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. The vulnerability may allow an attacker to inject malicious script.
- CVE-2023-42343Medium
A Cross-Site Scripting (XSS) vulnerability exists in Alkacon OpenCms before 10.5.1 via cmis-online/type.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS