CVE-2026-42425: high-severity vulnerability in OpenKM Community Edition
OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery
Published
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.6epss 0.9%
exploitation probability
0.9%top 42% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
public PoCs found — 1
cve_referencewww.exploit-db.com/exploits/52520unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — OpenKM Community Edition
In the same product, most dangerous first.
References
https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploitshttps://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-sql-database-queryhttps://hub.docker.com/r/openkm/openkm-cehttps://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labshttps://www.exploit-db.com/exploits/52520https://www.openkm.com/https://www.vulncheck.com/advisories/openkm-unrestricted-sql-execution-via-databasequery