OpenCMS 14 & 15 - Cross Site Scripting
Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template.
CVSS6.1EPSS 18.6%
共找到 4 条公开漏洞记录
Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template.
Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template
users can execute code without authentication. An attacker can execute malicious requests on the OpenCms server. When the requests are successful vulnerable OpenCms can be exploited resulting in an unauthenticated XXE vulnerability. Based on research OpenCMS versions from 9.0.0 to 10.5.0 are vulnerable.
OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability.