TI-2021-07974 Aliases CVE-2021-25968 GHSA-p799-qjp6-h93p

OpenCMS - Stored Cross-Site Scripting (XSS) in Sitemap

MEDIUM 58CWE-79Published 2021-10-19 · Updated 2025-04-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

In “OpenCMS”, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00514 44th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
org.opencms	opencms-core	10.5.0 and later; up to 11.0.2	—	No fix listed	CNA

opencms-core Vendororg.opencms Affected 10.5.0 and later; up to 11.0.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:alkacon:opencms::::::::	10.5.0 to before 11.0.2	Vulnerable	Alkacon

cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:* Versions 10.5.0 to before 11.0.2 Vulnerable ·Alkacon

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-25968
2026-10-03 Alias added: GHSA-p799-qjp6-h93p

References

Patch 1

https://github.com/alkacon/mercury-template/commit/800945f5d02346c633c7aef9f5d596d7dedc8fb5

Other 1

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25968

TI-2024-28583 Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS… CVSS 3.1MEDIUM 6.5
TI-2023-19187 An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon… CVSS 3.1MEDIUM 6.1
TI-2024-27633 A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows… CVSS 3.1MEDIUM 5.4
TI-2024-27632 A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows… CVSS 3.1MEDIUM 5.4
TI-2023-15113 A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows… CVSS 3.1MEDIUM 5.4
TI-2018-06358 Cross-site request forgery (CSRF) vulnerability in… CVSS 3.0HIGH 8.8

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences