High

DATE	CVE	VULNERABILITY TITLE	RISK
2019-05-08	CVE-2019-11819	Improper Neutralization of Formula Elements in a CSV File vulnerability in Alkacon Opencms Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name. local low complexity alkacon CWE-1236	7.8
2018-03-20	CVE-2018-8811	Cross-Site Request Forgery (CSRF) vulnerability in Alkacon Opencms 10.5.3 Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. network low complexity alkacon CWE-352	8.8