DS
Product
Document Server
On CISA KEVExploited in the wild
22
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 13High 4Medium 5Low 0
Watch
Add Document Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-46988 | 6.7 | Apr 1 | Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the… Affected: 7.4.0 before 8.0.1 |
| CVE-2025-68936 | 6.1 | Dec 25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name Affected: before 9.2.1 |
| CVE-2025-68935 | 6.1 | Dec 25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window Affected: before 9.2.1 |
| CVE-2023-50883 | 6.1 | Sep 9 | ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the… Affected: before 8.0.1 |
| CVE-2022-24229 | 6.1 | Apr 8 | A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor Affected: before 7.0.0 |
Showing 5