Alfresco
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Alfresco.
By the Year
In 2026 there have been 0 vulnerabilities in Alfresco. Alfresco did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 3 | 0.00 |
| 2019 | 5 | 9.80 |
It may take a day or so for new Alfresco vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Alfresco Security Vulnerabilities
Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0
CVE-2020-18327
- March 04, 2022
Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS
CVE-2020-8776
- March 02, 2020
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS
CVE-2020-8777
- March 02, 2020
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS
CVE-2020-8778
- March 02, 2020
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.
Alfresco Enterprise before 5.2.5
CVE-2019-19496
- December 02, 2019
Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.
An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N
CVE-2019-14223
- September 06, 2019
An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating the POST parameters, an attacker can redirect a victim to a malicious website over any protocol the attacker desires (e.g.,http, https, ftp, smb, etc.).
An issue was discovered in Alfresco Community Edition versions 6.0 and lower
CVE-2019-14222
- September 05, 2019
An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker could exploit this vulnerability by using the extracted private key and bundling it into a PKCS12. A successful exploit could allow the attacker to gain information about the target system (e.g., OS type, system file locations, Java version, Solr version, etc.) as well as the ability to launch further attacks by leveraging the access to Alfresco's Solr Web Admin Interface.
An issue was discovered in Alfresco Community Edition 5.2 201707
CVE-2019-14224
- September 05, 2019
An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications, an exploit chain was observed that allows an attacker to achieve remote code execution on the victim machine. The attacker must upload malicious Solr configuration files and then receive a JMX connection from the victim, and serve a Java object that results in deserialization and code execution.
The Alfresco application before 1.8.7 for Android
CVE-2019-15566
9.8 - Critical
- August 26, 2019
The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.
SQL Injection
