OpenKM Community Edition vulnerabilities
4 known vulnerabilities in OpenKM Community Edition from OpenKM. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
OpenKM Community Edition: Missing Authorization
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower lay
- 8.3 High severity
OpenKM Community Edition: Improper Restriction of XML External Entity Reference
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attac
- 7.2 High severity
OpenKM Community Edition: Improper Control of Generation of Code
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate paramete
- 7.2 High severity
OpenKM Community Edition: Improper Neutralization of Special Elements used in an SQL Command
OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries t