Filtered by vendor Hyland Subscriptions
Filtered by product Alfresco Content Services Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-26336 3 Alfresco, Atlassian, Hyland 5 Community Share, Alfresco Enterprise Content Management, Alfresco Community and 2 more 2026-03-05 7.5 High
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.
CVE-2024-40347 1 Hyland 1 Alfresco Content Services 2025-03-18 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter htmlid.
CVE-2023-49964 1 Hyland 1 Alfresco Content Services 2024-11-21 8.8 High
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.