alkacon opencms apollo template vulnerabilities

Latest alkacon opencms apollo template CVEs

Newest publication first

1. CVE-2019-13237 Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms

   Published 2019-08-27

   Medium·CVSS 4.3 EPSS 7.3% Public exploit

   In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/se...

2. CVE-2019-13235 XSS in login form

   Published 2019-08-27

   Medium·CVSS 6.1 EPSS 2.9% Public exploit

   In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.

3. CVE-2019-13234 XSS in search engine

   Published 2019-08-27

   Medium·CVSS 6.1 EPSS 2.9% Public exploit

   In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.