CVE-2025-57244

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/wolffangsecurity/CVEs/blob/main/Stored%20XSS%20via%20Input%20Fields%20with%20Inconsistent%20Client-Side%20and%20Server-Side%20Validation%20Writeup.md	Broken Link
https://github.com/wolffangsecurity/CVEs/tree/main/CVE-2025-57244	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openkm:openkm:6.3.12:*:*:*:community:*:*:*

History

27 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) OpenKM Community Edition 6.3.12 es vulnerable a cross-site scripting (XSS) almacenado en la interfaz de creación de cuentas de usuario. El campo Nombre acepta etiquetas de script y el campo Correo electrónico es vulnerable cuando la solicitud POST se modifica para incluir etiquetas de script codificadas, eludiendo la validación de frontend.

Information

Published : 2025-11-05 17:15

Updated : 2026-10-27 12:10

NVD link : CVE-2025-57244

Mitre link : CVE-2025-57244

CVE.ORG link : CVE-2025-57244

JSON object : View

Products Affected

openkm

openkm

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-57244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57244", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T19:55:20.184783Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-11-05T17:15:44.543", "references": [{"url": "https://github.com/wolffangsecurity/CVEs/blob/main/Stored%20XSS%20via%20Input%20Fields%20with%20Inconsistent%20Client-Side%20and%20Server-Side%20Validation%20Writeup.md", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://github.com/wolffangsecurity/CVEs/tree/main/CVE-2025-57244", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation."}, {"lang": "es", "value": "OpenKM Community Edition 6.3.12 es vulnerable a cross-site scripting (XSS) almacenado en la interfaz de creaci\u00f3n de cuentas de usuario. El campo Nombre acepta etiquetas de script y el campo Correo electr\u00f3nico es vulnerable cuando la solicitud POST se modifica para incluir etiquetas de script codificadas, eludiendo la validaci\u00f3n de frontend."}], "lastModified": "2026-10-27T12:10:00.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openkm:openkm:6.3.12:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C1E76DAF-D676-4056-89B9-E8AFF46450E6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}