ByteOS Network

CVE Vulnerability Details :

CVE-2026-2735

PUBLISHED

More Info Official Page

Assigner-INCIBE

Assigner Org ID-0cbda920-cd7f-484a-8e76-bf7f4b7f4516

Published At-19 Feb, 2026 | 08:38

Updated At-19 Feb, 2026 | 08:38

▼CVE Numbering Authority (CNA)

Stored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms

Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-article/org.opencms.ugc.CmsUgcEditService.gwt’ using the ‘text’ parameter.

Affected Products

Vendor

Alkacon

Product

OpenCms

Default Status

unaffected

Versions

Affected

18.0

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
4.0	5.1	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Version: 4.0

Base score: 5.1

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Solutions

The vulnerabilities have been fixed by the Alkacon team in version 19.0.

Credits

finder

Gonzalo Aguilar García (6h4ack)

References

Hyperlink	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacons-opencms	patch

Hyperlink: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacons-opencms

Resource:

patch

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References