DS
Product
Document Server
On CISA KEVExploited in the wild
22
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 13High 4Medium 5Low 0
Watch
Add Document Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3199 In wildKEV | 9.8 | Jan 22 | ONLYOFFICE Docs Server Path Traversal Vulnerability Affected: before 5.6.3 |
| CVE-2023-30187 | 9.8 | Aug 14 | An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file Affected: 4.0.3 through 7.3.2 |
| CVE-2023-30186 | 9.8 | Aug 14 | A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file Affected: 4.0.3 through 7.3.2 |
| CVE-2022-29777 | 9.8 | Jun 2 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component… Affected: through 6.0.0 |
| CVE-2022-29776 | 9.8 | Jun 2 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp Affected: through 6.0.0 |
| CVE-2021-25833 | 9.8 | Mar 1 | A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21 Affected: 4.2.0.71 through 5.6.0.21 |
| CVE-2021-25832 | 9.8 | Mar 1 | A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0 Affected: 4.0.0-9 through 6.0.0 |
| CVE-2021-25831 | 9.8 | Mar 1 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3 Affected: 4.0.0-9 through 5.6.3 |
| CVE-2021-25830 | 9.8 | Mar 1 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13 Affected: 4.2.0.236 through 5.6.4.13 |
| CVE-2020-11537 | 9.8 | Apr 15 | A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0 Affected: 5.5.0 |
| CVE-2020-11536 | 9.8 | Apr 15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0 Affected: 5.5.0 |
| CVE-2020-11535 | 9.8 | Apr 15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0 Affected: 5.5.0 |
| CVE-2020-11534 | 9.8 | Apr 15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0 Affected: 5.5.0 |
| CVE-2026-110385 | 8.7 | Oct 14 | A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary… Affected: before 10.0 |
| CVE-2022-48422 | 7.8 | Mar 19 | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be… Affected: through 7.3.0 |
| CVE-2023-30188 | 7.5 | Aug 14 | Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file Affected: 4.0.3 through 7.3.2 |
| CVE-2021-25829 | 7.5 | Mar 1 | An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3 Affected: 4.0.0-9 through 5.6.3 |
| CVE-2023-46988 | 6.7 | Apr 1 | Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the… Affected: 7.4.0 before 8.0.1 |
| CVE-2025-68936 | 6.1 | Dec 25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name Affected: before 9.2.1 |
| CVE-2025-68935 | 6.1 | Dec 25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window Affected: before 9.2.1 |
| CVE-2023-50883 | 6.1 | Sep 9 | ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the… Affected: before 8.0.1 |
| CVE-2022-24229 | 6.1 | Apr 8 | A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor Affected: before 7.0.0 |
Showing 22