NVD HIGH: CVE-2026-42425 — OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows a...

Tuesday, May 26, 2026 at 03:16 PM UTC·Source: NIST NVD

Updated: Monday, June 1, 2026 at 02:00 PM UTC

Executive Summary

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-42425

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on May 26, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

EBA and NYDFS ink stablecoin MoU

The European Banking Authority (EBA) has signed a Memorandum of Understanding (MoU) with the New York State Department of Financial Services (NYDFS) under the Markets in Crypto-Assets Regulation (MiCA).

Just nowFinextra

MEDIUMVulnerabilityNEW

Affirm BNPL options come to Stripe merchants in the UK

Affirm and Stripe today announced an expanded partnership that will bring Affirm’s pay-over-time solutions to Stripe merchants in the UK for the first time.

Just nowFinextra

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-0611 — Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6....

Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to perform arbitrary file read and write operations by supplying valid .NET URI endpoints. Attackers can write ASPX webshells to the IIS wwwroot directory to achiev

CVE-2026-0611

57m agoNIST NVD