GHSA-pmfx-p95x-cg4pLow

Alkacon OpenCms XSS via query parameter in a search action

Published
May 1, 2022
Last Modified
June 20, 2025

🔗 CVE IDs covered (1)

CVE-2006-2571 →

📋 Description

Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action.

🎯 Affected products1

  • maven/org.opencms:opencms-core:>= 6.0.0, < 6.0.4

🔗 References (4)