https://vulnogram.org/ Most recent CVEs assigned by OpenText (formerly Micro Focus) (opentext). https://vulnogram.org/seaview/icons/opentext.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-75120 https://vulnogram.org/CVE-2026-75120 The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that c… Critical Network Exploitable Tue, 13 Oct 2026 18:02:10 GMT https://vulnogram.org/CVE-2025-15591 https://vulnogram.org/CVE-2025-15591 Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page. Medium Network Exploitable Tue, 06 Oct 2026 13:28:04 GMT https://vulnogram.org/CVE-2026-12559 https://vulnogram.org/CVE-2026-12559 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in… High Thu, 24 Sep 2026 14:18:21 GMT https://vulnogram.org/CVE-2025-3271 https://vulnogram.org/CVE-2025-3271 Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS Medium Wed, 09 Sep 2026 09:14:31 GMT https://vulnogram.org/CVE-2026-13202 https://vulnogram.org/CVE-2026-13202 A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2. High Network Exploitable Mon, 17 Aug 2026 15:04:49 GMT https://vulnogram.org/CVE-2026-11877 https://vulnogram.org/CVE-2026-11877 An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3. Medium Network Exploitable Wed, 24 Jun 2026 14:01:38 GMT https://vulnogram.org/CVE-2026-11878 https://vulnogram.org/CVE-2026-11878 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-Site Scripting (XSS). This issue affects Access Manager: from 5.1 through 5.1.2. High Network Exploitable Wed, 24 Jun 2026 14:01:26 GMT https://vulnogram.org/CVE-2025-15610 https://vulnogram.org/CVE-2025-15610 The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploited if the service is exposed in environments where the remoting ports are accessible. Critical Network Exploitable Wed, 15 Apr 2026 16:31:53 GMT https://vulnogram.org/CVE-2026-2123 https://vulnogram.org/CVE-2026-2123 A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of… High Tue, 31 Mar 2026 17:18:43 GMT https://vulnogram.org/CVE-2024-11604 https://vulnogram.org/CVE-2024-11604 Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files. This is… High Fri, 27 Mar 2026 14:08:59 GMT https://vulnogram.org/CVE-2025-13478 https://vulnogram.org/CVE-2025-13478 Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via insecure application cache handling. This issue affects Identity Manager: 25.2(v4.10.1). High Fri, 27 Mar 2026 13:43:34 GMT https://vulnogram.org/CVE-2026-3278 https://vulnogram.org/CVE-2026-3278 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripting (XSS). The vulnerability could allow an attacker to execute arbitrary JavaScript leading… High Wed, 18 Mar 2026 13:49:28 GMT https://vulnogram.org/CVE-2025-12453 https://vulnogram.org/CVE-2025-12453 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console a… Medium Network Exploitable Fri, 13 Mar 2026 18:30:53 GMT https://vulnogram.org/CVE-2025-12454 https://vulnogram.org/CVE-2025-12454 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console a… Medium Network Exploitable Fri, 13 Mar 2026 18:30:40 GMT https://vulnogram.org/CVE-2025-12455 https://vulnogram.org/CVE-2025-12455 Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing. The vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, fro… Medium Network Exploitable Fri, 13 Mar 2026 18:30:27 GMT https://vulnogram.org/CVE-2026-3266 https://vulnogram.org/CVE-2026-3266 Missing Authorization vulnerability in OpenText™ Filr allows Authentication Bypass. The vulnerability could allow unauthenticated users to get XSRF token and do RPC with carefully crafted programs. This issue affects Filr: through 25.1.2. High Network Exploitable Tue, 03 Mar 2026 22:28:52 GMT https://vulnogram.org/CVE-2025-9120 https://vulnogram.org/CVE-2025-9120 Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. The vulnerability could be exploited through an open port, potentially allowing unauthorized access. This issue a… High Tue, 24 Feb 2026 00:03:08 GMT https://vulnogram.org/CVE-2026-1658 https://vulnogram.org/CVE-2026-1658 User Interface (UI) Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning. The vulnerability could be exploited by a bad actor to inject manipulated text into the OpenText application, potentia… Medium Network Exploitable Thu, 19 Feb 2026 22:40:33 GMT https://vulnogram.org/CVE-2025-9208 https://vulnogram.org/CVE-2025-9208 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored XSS. The vulnerability could execute malicious scripts on the client side when the downloa… High Thu, 19 Feb 2026 22:37:19 GMT https://vulnogram.org/CVE-2025-13671 https://vulnogram.org/CVE-2025-13671 Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability could make a user, with active session inside the product, click on a page that contains this malicious HTML… Medium Thu, 19 Feb 2026 22:36:49 GMT https://vulnogram.org/CVE-2025-13672 https://vulnogram.org/CVE-2025-13672 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflected XSS. The vulnerability could allow injecting malicious JavaScript inside URL parameters… High Thu, 19 Feb 2026 22:36:33 GMT https://vulnogram.org/CVE-2025-8054 https://vulnogram.org/CVE-2025-8054 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText™ XM Fax allows Path Traversal. The vulnerability could allow an attacker to arbitrarily disclose content of files on the local filesystem. This i… High Thu, 19 Feb 2026 22:21:22 GMT https://vulnogram.org/CVE-2025-8055 https://vulnogram.org/CVE-2025-8055 Server-Side Request Forgery (SSRF) vulnerability in OpenText™ XM Fax allows Server Side Request Forgery. The vulnerability could allow an attacker to perform blind SSRF to other systems accessible from the XM Fax server. This issue affects XM Fax: 24… Medium Network Exploitable Thu, 19 Feb 2026 22:21:06 GMT https://vulnogram.org/CVE-2025-15579 https://vulnogram.org/CVE-2025-15579 Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before… Critical Network Exploitable Wed, 18 Feb 2026 14:57:04 GMT https://vulnogram.org/CVE-2024-9432 https://vulnogram.org/CVE-2024-9432 Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data. The vulnerability could read Vertica agent plaintext apikey.This issue affects Vertica versions: 23.X, 24.X, 25.X. Medium Fri, 30 Jan 2026 18:31:31 GMT https://vulnogram.org/CVE-2025-11884 https://vulnogram.org/CVE-2025-11884 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in opentext uCMDB allows Stored XSS. The vulnerability could allow an attacker has high level access to UCMDB to create or update data with mali… Low Wed, 19 Nov 2025 21:13:48 GMT https://vulnogram.org/CVE-2025-8050 https://vulnogram.org/CVE-2025-8050 External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to access files hosted on the server. This issue affects Flipper: 3.1.2. Medium Network Exploitable Tue, 21 Oct 2025 17:21:30 GMT https://vulnogram.org/CVE-2025-8052 https://vulnogram.org/CVE-2025-8052 SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor. This issue affects Flipp… Low Mon, 20 Oct 2025 19:57:34 GMT https://vulnogram.org/CVE-2025-8048 https://vulnogram.org/CVE-2025-8048 External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local file path and then download the specified file from the system by requesting the stored docum… Medium Network Exploitable Mon, 20 Oct 2025 19:56:29 GMT https://vulnogram.org/CVE-2025-8049 https://vulnogram.org/CVE-2025-8049 Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low-privilege user to elevate privileges within the application. Thi… Low Network Exploitable Mon, 20 Oct 2025 19:56:20 GMT https://vulnogram.org/CVE-2025-8051 https://vulnogram.org/CVE-2025-8051 Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal. The vulnerability could allow a user to access files hosted on the server. This issue affects Flipper: 3.1.2. Medium Network Exploitable Mon, 20 Oct 2025 19:55:57 GMT https://vulnogram.org/CVE-2025-8053 https://vulnogram.org/CVE-2025-8053 Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low privilege user to interact with the backend API without sufficie… Low Mon, 20 Oct 2025 19:55:17 GMT https://vulnogram.org/CVE-2025-8716 https://vulnogram.org/CVE-2025-8716 In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known. Medium Thu, 11 Sep 2025 13:42:01 GMT https://vulnogram.org/CVE-2025-5808 https://vulnogram.org/CVE-2025-5808 Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset from before 4.8 patch 3. High Fri, 29 Aug 2025 15:38:49 GMT https://vulnogram.org/CVE-2025-3478 https://vulnogram.org/CVE-2025-3478 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. High Mon, 25 Aug 2025 15:46:27 GMT https://vulnogram.org/CVE-2025-8997 https://vulnogram.org/CVE-2025-8997 An Information Exposure vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. Medium Mon, 25 Aug 2025 06:30:24 GMT https://vulnogram.org/CVE-2025-8616 https://vulnogram.org/CVE-2025-8616 A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Authentication. This issue affects Advanced Authentication on or before 6.5.0. Medium Network Exploitable Wed, 06 Aug 2025 14:10:25 GMT https://vulnogram.org/CVE-2024-7650 https://vulnogram.org/CVE-2024-7650 Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vulnerability could allow access to the system via script injection.This issue affects Directory Services: 23.4. Medium Network Exploitable Thu, 10 Jul 2025 10:02:58 GMT https://vulnogram.org/CVE-2025-0885 https://vulnogram.org/CVE-2025-0885 Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow unauthorized access to calendar items marked private. This issue affects GroupWise ver… Low Thu, 03 Jul 2025 09:54:20 GMT https://vulnogram.org/CVE-2025-2236 https://vulnogram.org/CVE-2025-2236 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. The vulnerability could reveal sensitive information while managing and configuring of the ex… Low Tue, 27 May 2025 15:00:30 GMT https://vulnogram.org/CVE-2024-10865 https://vulnogram.org/CVE-2024-10865 Improper Input validation leads to XSS or Cross-site Scripting vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication versions before 6.5. Critical Network Exploitable Wed, 14 May 2025 14:18:57 GMT https://vulnogram.org/CVE-2024-10864 https://vulnogram.org/CVE-2024-10864 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication versions before 6.5 High Wed, 14 May 2025 14:18:45 GMT https://vulnogram.org/CVE-2025-3272 https://vulnogram.org/CVE-2025-3272 Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password without providing their old password. This issue affects Operations Bridge Manager: 24.2, 24.4. Medium Wed, 07 May 2025 18:42:19 GMT https://vulnogram.org/CVE-2025-3476 https://vulnogram.org/CVE-2025-3476 Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This issue affects Operations Bridge Manager: 2023.05, 23.4, 24.2, 24.4. Critical Wed, 07 May 2025 18:42:08 GMT https://vulnogram.org/CVE-2024-12706 https://vulnogram.org/CVE-2024-12706 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital Asset Management. T he vulnerability could allow an authenticated user to run arbitrary SQL commands on the underlying database. T… Low Mon, 28 Apr 2025 17:59:56 GMT https://vulnogram.org/CVE-2024-12543 https://vulnogram.org/CVE-2024-12543 User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows and Linux allows a malicous authenticated attacker to potentially alter barcode attributes. Medium Mon, 21 Apr 2025 15:14:20 GMT https://vulnogram.org/CVE-2024-12863 https://vulnogram.org/CVE-2024-12863 Stored XSS in Discussions in OpenText Content Management CE 20.2 to 25.1 on Windows and Linux allows authenticated malicious users to inject code into the system. Medium Mon, 21 Apr 2025 15:13:04 GMT https://vulnogram.org/CVE-2025-2517 https://vulnogram.org/CVE-2025-2517 Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager. Low Network Exploitable Mon, 21 Apr 2025 14:26:04 GMT https://vulnogram.org/CVE-2024-12862 https://vulnogram.org/CVE-2024-12862 Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove external collaborators.This issue affects Content Server: 20.2-24.4. Medium Mon, 21 Apr 2025 14:22:59 GMT https://vulnogram.org/CVE-2024-12530 https://vulnogram.org/CVE-2024-12530 Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: 23.4. End-users can potentially exploit the vulnerability to execute malicious code in the… High Thu, 17 Apr 2025 15:35:32 GMT