CVE-2019-13237

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

• CWE-22

• http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
• https://aetsu.github.io/OpenCmsExploit, Third Party Advisory
• https://github.com/alkacon/opencms-core/commits/branch_10_5_xPatch
• http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
• https://aetsu.github.io/OpenCmsExploit, Third Party Advisory
• https://github.com/alkacon/opencms-core/commits/branch_10_5_xPatch

Published

Aug 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1323An elevation of privilege vulnerability exists in the Micros…7.8
• CVE-2019-13232Info-ZIP UnZip 6.0 mishandles the overlapping of files insid…3.3
• CVE-2019-13233In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9…
• CVE-2019-13234In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, th…
• CVE-2019-13235In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, th…
• CVE-2019-13236In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, t…
• CVE-2019-13238An issue was discovered in Bento4 1.5.1.0. A memory allocati…
• CVE-2019-13239inc/user.class.php in GLPI before 9.4.3 allows XSS via a use…
• CVE-2019-1324An information disclosure vulnerability exists when the Wind…5.3
• CVE-2019-13240An issue was discovered in GLPI before 9.4.1. After a succes…
• CVE-2019-13241FlightCrew v0.9.2 and older are vulnerable to a directory tr…7.8
• CVE-2019-13242IrfanView 4.52 has a User Mode Write AV starting at image004…