CVE-2023-42346

HIGH

Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.

Affects 0 products across 1 vendor.

CVSS 3.17.5
EPSS0.2%
Percentile13th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-611: CWE-611
Related Attack Patterns (CAPEC)
CAPEC-221 Data Serialization External Entities Blowup
via CWE-611

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Alkacon OpenCms versions prior to 16 are vulnerable to XML External Entity (XXE) attacks when the <!DOCTYPE> declaration references an external host.

BSID: BS-2026-GLOBAL-344971-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-42346?
Alkacon OpenCms versions prior to 16 are vulnerable to XML External Entity (XXE) attacks when the <!DOCTYPE> declaration references an external host.
What is the CVSS score for CVE-2023-42346?
CVE-2023-42346 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 0.2%.
Is CVE-2023-42346 actively exploited?
No confirmed active exploitation of CVE-2023-42346 as of 2026-05-30.
How do I remediate CVE-2023-42346?
Priority: HIGH.
What systems are affected by CVE-2023-42346?
CVE-2023-42346 affects Alkacon.
Vulnerability Details
CVE IDCVE-2023-42346
BSIDBS-2026-GLOBAL-344971-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2026-05-08
Last Modified2026-05-11
ICS Relevance0%
Weakness (CWE)
CWE-611
SourceNVD
Official Description

Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by crafting a malicious XML document with a <!DOCTYPE> declaration that references an external entity hosted on a server they control. This can lead to unauthorized access to internal files, internal port scanning, remote code execution, or denial of service.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Alkacon — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 161 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash78bc318d381d87dd475ebc4313d94e867578ab71e262689450d704f48119ce4e53c03d1dddd3602a8c78476b6049e3070596c537c6bb05b476f9cada431bfd02
Related CVEs affecting Alkacon
CVE-2018-8811 8.8 Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/acc... CVE-2019-11819 7.8 Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injec... CVE-2023-42344 7.3 Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obta... CVE-2005-4475 6.8 Cross-site scripting (XSS) vulnerability in OpenCms 6.0.3 and earlier allows ... CVE-2006-3935 6.5 system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 d...
View all Alkacon CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →