{"id":"CVE-2019-13236","details":"In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.","aliases":["GHSA-7qqr-3pj3-q2f5"],"modified":"2026-08-07T11:31:28.960083984Z","published":"2019-08-27T12:15:12.517Z","database_specific":{"unresolved_ranges":[{"vendor_product":"alkacon:opencms","cpes":["cpe:2.3:a:alkacon:opencms:10.5.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.5.5"},{"last_affected":"10.5.5"}],"source":"CPE_STRING"}]},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/154283/Alkacon-OpenCMS-10.5.x-Cross-Site-Scripting.html"},{"type":"ADVISORY","url":"https://twitter.com/aetsu/status/1152096227938459648"},{"type":"FIX","url":"https://github.com/alkacon/opencms-core/commits/branch_10_5_x"},{"type":"EVIDENCE","url":"https://aetsu.github.io/OpenCms"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alkacon/opencms-core","events":[{"introduced":"86ae0830160f353685212dae48d383e594dfd322"},{"last_affected":"86ae0830160f353685212dae48d383e594dfd322"}],"database_specific":{"source":"CPE_STRING","cpe":"cpe:2.3:a:alkacon:opencms:10.5.4:*:*:*:*:*:*:*","extracted_events":[{"introduced":"10.5.4"},{"last_affected":"10.5.4"}]}}],"versions":["10.5.4","build_10_5_4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13236.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}