CVE-2026-42425CWE-89sql-injection

CVE-2026-42425

High · published May 26, 2026

CVSS v3.1

7.2

EPSS

Percentile

59.0

In the wild

Unconfirmed

What it is

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00891 · 59.0th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-05-26T19:16Z

References (7)

https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits · [email protected]https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-sql-database-query · [email protected]https://hub.docker.com/r/openkm/openkm-ce · [email protected]https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs · [email protected]https://www.exploit-db.com/exploits/52520 · [email protected]https://www.openkm.com/ · [email protected]https://www.vulncheck.com/advisories/openkm-unrestricted-sql-execution-via-databasequery · [email protected]

EPSS history

Timeline

26 MAY 14:08Z
OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery
cvelistv5