owndms vulnerabilities

Products

• ownDMS 1
• ownticket 1

Latest owndms CVEs

Newest publication first

1. CVE-2019-25580 ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php

   Published 2026-03-21

   High·CVSS 8.8 EPSS 0.34%

   ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQ...

2. CVE-2018-18527 OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter.

   Published 2018-10-19

   Critical·CVSS 9.8 EPSS 1.6%

   OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.