Approved changes feed: RSS · Atom
cpe:2.3:a:openkm:openkm:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Openkm (89aa1560-2c00-5e95-b032-1e4593567957) |
|---|---|
| Product | Openkm (9f7b9775-4e33-5cf3-ad6f-abb6932c0e46) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/openkm/openkm-ce |
purl2cpe | 2026-06-01 10:12:59.762294 |
pkg:github/openkm/document-management-system |
purl2cpe | 2026-06-01 10:12:59.762296 |
pkg:pypi/django-openkm |
purl2cpe | 2026-06-01 10:12:59.762298 |
pkg:sourceforge/openkm |
purl2cpe | 2026-06-01 10:12:59.762299 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-47414 |
vulnerable | 2026-06-08 05:50:40.397024 |
Details available
If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
Published: 2023-02-07T21:41:39.203Z
Updated: 2025-03-25T14:08:10.227Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47413 |
vulnerable | 2026-06-08 05:50:40.395634 |
Details available
Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.
Published: 2023-02-07T21:37:34.095Z
Updated: 2025-03-25T14:08:53.524Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3969 |
vulnerable | 2026-06-08 05:48:22.724178 |
OpenKM FileUtils.java getFileExtension temp file
LOW (2.6)
A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.
Published: 2022-11-13T00:00:00.000Z
Updated: 2025-04-15T13:15:23.474Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11445 |
vulnerable | 2026-06-08 05:12:37.159548 |
Details available
OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.
Published: 2019-04-22T04:00:49.000Z
Updated: 2024-08-04T22:55:39.702Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2315 |
vulnerable | 2026-06-08 05:02:03.402588 |
Details available
admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action.
Published: 2012-09-09T21:00:00.000Z
Updated: 2024-08-06T19:26:09.023Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-2226 |
vulnerable | 2026-06-08 04:50:23.231216 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.