OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the appli…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 26, 2026 · NIST NVD

   Detected

   OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_

2. Oct 6, 2026 · NIST NVD

   Updated

   OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_

Sources

• CVE.orgVulnerability recordCVE-2026-42425

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-42425

  OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parame

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · hub.docker.com
• Reference · terrasystemlabs.com
• Reference · exploit-db.com
• Reference · openkm.com
• Reference · vulncheck.com