Vulnerabilities

TI-2026-80141 CVE-2026-116058 · GHSA-c3mq-gp3c-q93q

Code injection in Alfresco Activiti JuelScriptEngine eval

LOW 24

A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00376 Published 2026-10-25 No fix listed CWE-74

TI-2026-03431 CVE-2026-3967 · GHSA-7wmq-q36p-g2wg

Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization

MEDIUM 57

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00282 Published 2026-03-12 No fix listed CWE-20

TI-2020-13368 CVE-2020-18327 · GHSA-r82g-4j97-fq26

Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition…

LOW 29

Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00866 Published 2022-03-04 No fix listed CWE-79

TI-2021-18428 CVE-2021-41792 · GHSA-4p6q-fx36-35xg

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18…

LOW 26

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00856 Published 2021-10-21 No fix listed CWE-918

TI-2021-18427 CVE-2021-41791 · GHSA-v5mw-3h54-qc2w

An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and…

LOW 25

An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00551 Published 2021-10-21 No fix listed CWE-79

TI-2021-18426 CVE-2021-41790 · GHSA-7v5m-mjhx-x6gc

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2.

MEDIUM 41

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01469 Published 2021-10-21 No fix listed

TI-2020-11953 CVE-2020-15181

Admin account takeover in Alfresco Reset Password

MEDIUM 45

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01423 Published 2020-09-18 Fixed in 1.2.0 CWE-20

TI-2020-15741 CVE-2020-25728 · GHSA-xghg-58h4-gjjw

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an…

MEDIUM 40

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01001 Published 2020-09-17 No fix listed CWE-640

TI-2020-07039 CVE-2020-8778 · GHSA-3wq2-f93g-wx78

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has…

LOW 29

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02621 Published 2020-03-02 No fix listed CWE-79

TI-2020-07038 CVE-2020-8777 · GHSA-p3vq-v25w-6m97

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has…

LOW 30

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0317 Published 2020-03-02 No fix listed CWE-79

TI-2020-07037 CVE-2020-8776 · GHSA-3pw8-m4pc-4r7g

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has…

LOW 29

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02676 Published 2020-03-02 No fix listed CWE-79

TI-2019-14045 CVE-2019-19496 · GHSA-r9vr-wvw6-c8v5

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.

LOW 25

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00602 Published 2019-12-02 No fix listed CWE-79

TI-2019-10585 CVE-2019-14223 · GHSA-r489-wv9g-p54f

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and…

LOW 35

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04474 Published 2019-09-06 No fix listed CWE-601

TI-2019-10584 CVE-2019-14222 · GHSA-63jc-fcpm-hjjw

An issue was discovered in Alfresco Community Edition versions 6.0 and lower.

MEDIUM 47

An issue was discovered in Alfresco Community Edition versions 6.0 and lower.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02932 Published 2019-09-05 No fix listed CWE-1188

TI-2019-10586 CVE-2019-14224 · GHSA-whfv-2c4g-wx2g

An issue was discovered in Alfresco Community Edition 5.2 201707.

MEDIUM 40

An issue was discovered in Alfresco Community Edition 5.2 201707.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.05128 Published 2019-09-05 No fix listed CWE-502

TI-2019-11666 CVE-2019-15566 · GHSA-f528-892h-rxcw

The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.

MEDIUM 45

The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01609 Published 2019-08-26 No fix listed CWE-89

TI-2015-02977 CVE-2015-3366 · GHSA-fh6j-89x6-p2jw

Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for…

LOW 27

Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete an alfresco node via unspe…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.00643 Published 2015-04-21 No fix listed CWE-352

TI-2014-07547 CVE-2014-9302 · GHSA-mvfq-76qv-w62r

Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content…

LOW 27

Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outboun…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02008 Published 2014-12-07 No fix listed

TI-2014-07546 CVE-2014-9301 · GHSA-747c-3wrr-q63m

Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco…

LOW 35

Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbi…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03927 Published 2014-12-07 No fix listed

TI-2014-07545 CVE-2014-9300 · GHSA-3fjj-qfv3-f9fj

Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content…

LOW 31

Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition before 5.0.a allows remote attackers to hijack the authentica…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00628 Published 2014-12-07 No fix listed CWE-352

TI-2014-02355 CVE-2014-2939 · GHSA-rm67-pq9p-r79c

Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId paramete…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01012 Published 2014-06-02 No fix listed CWE-79

Vulnerabilities

Filters