WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2012-01-01✕Vendor org.opencms✕Has a public PoC✕
Overview 7 matches · 2 protected · 1 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
7matches 2protected28.6% 1exploited14.3% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 28.6% Rule in development 0 0.0% Mitigation candidate 5 71.4% No exploit published 0 0.0%
Critical 0 0.0% High 1 14.3% Medium 6 85.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 28.6% partly blocked 0 0.0% not blocked 5 71.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 6 85.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Mitigation candidate: 5Protected by Waratek: 2 Medium: 6High: 1 not blocked: 5blocked by ARMR today: 2 Working exploit published: 6Exploited: 1
20194 Protected by Waratek1 Mitigation candidate3 Medium4 blocked by ARMR today1 not blocked3 Working exploit published4 20200 20210 20220 20231 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20240 20250 20262 Protected by Waratek1 Mitigation candidate1 High1 Medium1 blocked by ARMR today1 not blocked1 Exploited1 Working exploit published1
20192020202120222023202420252026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-42344 High 2026-05-08 Protected by Waratek Exploited Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
CVE-2023-42343 Medium 2026-05-08 Mitigation candidate Working exploit published A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
CVE-2023-6379 Medium 2023-12-13 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.
CVE-2019-13237 Medium 2019-08-27 Protected by Waratek Working exploit published In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
CVE-2019-13236 Medium 2019-08-27 Mitigation candidate Working exploit published In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
CVE-2019-13235 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
CVE-2019-13234 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.