CVE-2019-13235: XSS in login form in Alkacon OpenCms Apollo Template
Summary
CVE-2019-13235: XSS in login form. Affects org.opencms:opencms-core versions < 11.0.1. Fixed in 11.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCms Apollo Template is a template used in OpenCms versions 10.5.4 and 10.5.5. OpenCms is a content management system that allows users to create and manage websites. The Apollo Template provides a pre-designed layout and styling for OpenCms websites. However, this template is vulnerable to a cross-site scripting (XSS) attack in the login form.
Vulnerability Detail
The XSS vulnerability in the Alkacon OpenCms Apollo Template allows an attacker to inject malicious code into the login form. When a user submits the form, the injected code is executed in the context of the user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The XSS vulnerability in the Alkacon OpenCms Apollo Template can be mitigated by upgrading to OpenCms version 11.0.1 or later. It is recommended to apply the fix as soon as possible to prevent potential unauthorized access or data theft. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
Users of OpenCms versions 10.5.4 and 10.5.5 with the Alkacon OpenCms Apollo Template installed are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
You can use the Vulert Playground at Vulert Scanner to check if your OpenCms installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for vulnerabilities.
More information about the fix can be found in the OpenCms project's release notes for version 11.0.1.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
