OpenKM
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| OpenKM Community Edition | 3 | – | May 26, 2026 |
| OpenKM Professional Edition | 3 | – | May 26, 2026 |
| OpenKM | 2 | – | Feb 7, 2023 |
| Document Management Community | 1 | – | Aug 30, 2021 |
| OpenKM Document Management Community | 1 | – | Jul 25, 2022 |
Exploited and recent CVEs
- CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting 0.7%
- CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting 0.7%
- CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery 0.6%
- CVE-2026-42425 OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery 0.6%
- CVE-2026-41917 OpenKM 6.3.12 Local File Inclusion via Admin Scripting 0.4%
- CVE-2026-41917 OpenKM 6.3.12 Local File Inclusion via Admin Scripting 0.4%
- CVE-2022-47414 If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality. 0.5%
- CVE-2022-47413 Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition. 0.5%
- CVE-2022-2131 OpenKM XXE Injection 0.9%
- CVE-2021-3628 OpenKM Document Management Community vulnerable to Cross Site Scripting 0.9%