GCVE - cpe:2.3:a:openkm:openkm_professional_edition:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openkm:openkm_professional_edition:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Openkm (`89aa1560-2c00-5e95-b032-1e4593567957`)
Product	Openkm Professional Edition (`3cab003b-a9c2-5dfd-8a75-302144e284c4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-42785`	vulnerable	2026-06-08 08:03:16.674536	OpenKM 6.3.12 Remote Code Execution via Administrative Scripting HIGH (7.2) OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server. Published: 2026-05-26T14:08:51.032Z Updated: 2026-05-26T16:20:15.493Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/52520 https://www.openkm.com/ https://hub.docker.com/r/openkm/openkm-ce https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-42425`	vulnerable	2026-06-08 08:03:16.298037	OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery HIGH (7.2) OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records. Published: 2026-05-26T14:08:50.343Z Updated: 2026-05-26T15:14:09.128Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/52520 https://www.openkm.com/ https://hub.docker.com/r/openkm/openkm-ce https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-41917`	vulnerable	2026-06-08 08:03:15.768524	OpenKM 6.3.12 Local File Inclusion via Admin Scripting MEDIUM (4.9) OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process. Published: 2026-05-26T14:08:49.680Z Updated: 2026-05-27T16:08:59.835Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/52520 https://www.openkm.com/ https://hub.docker.com/r/openkm/openkm-ce https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.