Openkm vulnerabilities

Products

• Openkm 16
• Community Edition 3
• Professional Edition 3

Newest

• openkm community edition, professional edition +1 more OpenKM 6.3.12 Remote Code Execution via Administrative Scripting CVE-2026-42785 8.6 HighMay 26, 2026
• openkm community edition, professional edition +1 more OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery CVE-2026-42425 8.6 HighMay 26, 2026
• openkm community edition, professional edition +1 more OpenKM 6.3.12 Local File Inclusion via Admin Scripting CVE-2026-41917 6.9 MediumMay 26, 2026
• openkm OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user... CVE-2025-57244 5.4 MediumNovember 5, 2025
• openkm A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on... CVE-2024-35475 6.4 MediumMay 22, 2024
• openkm A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With... CVE-2023-50072 Public exploit 5.4 MediumJanuary 13, 2024
• openkm An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the... CVE-2021-33950 7.5 HighFebruary 17, 2023
• openkm If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS... CVE-2022-47414 5.4 MediumFebruary 7, 2023
• openkm Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored ... CVE-2022-47413 5.4 MediumFebruary 7, 2023
• openkm OpenKM FileUtils.java getFileExtension temp file CVE-2022-3969 2.6 LowNovember 13, 2022
• openkm OpenKM 6.3.11 allows stored XSS related to the javascript: substring in an A element. CVE-2022-40317 Public exploit 5.4 MediumSeptember 9, 2022
• openkm, openkm document management community +1 more OpenKM XXE Injection CVE-2022-2131 8.5 HighJuly 25, 2022
• openkm document management community, openkm +1 more OpenKM Document Management Community vulnerable to Cross Site Scripting CVE-2021-3628 4.6 MediumAugust 30, 2021
• openkm OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root... CVE-2019-11445 Public exploit EPSS 14.2% 7.2 HighApril 22, 2019
• openkm Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 allows remote authenticated... CVE-2014-8957 5.4 MediumOctober 6, 2017
• openkm Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338) allows remote... CVE-2014-9017 3.5 LowMarch 11, 2015
• openkm Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7... CVE-2012-2316 Public exploit 6.8 MediumSeptember 9, 2012
• openkm admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges... CVE-2012-2315 Public exploit 4.0 MediumSeptember 9, 2012
• openkm Unspecified vulnerability in the export feature in OpenKM before 2.0 allows remote attackers to... CVE-2008-2226 5.0 MediumMay 14, 2008