59 matches found
CVE-2026-93643
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
EUVD-2026-87101
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
CVE-2026-93643: Improper Limitation of a Pathname to a Restricted Directory
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
PT-2026-98865
Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing affected versions not specified Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the...
VK WorkMail Blind SSRF
The vulnerability of corporate email for VK WorkMail is related to insufficient validation of requests on the server side when integration with document editing services is enabled. Exploiting this vulnerability could allow a malicious actor to execute a Blind SSRF attack remotely...
Malicious Package
Overview acc-document-editing is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-4474 Malicious code in acc-document-editing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c82ee7b879d66ba2fb79ec7ad7fee47623c2c3b68c8a925510b1f42cd1e3456 The DocumentEditor React component exported by this package, when an end-user opens a.doc file, POSTs the raw file bytes to...
CVE-2026-22867
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting XSS vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacke...
CVE-2023-29043
Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious documents could be executed in the context of the user editing the document when performing certain...
OpenPDF PDF Library Arbitrary File Read
The vulnerability of the OpenPDF library for creating and editing PDF documents is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to read arbitrary files...
PT-2025-62911
Уязвимость корпоративной почты для бизнеса VK WorkMail связана с недостаточной проверкой запросов на стороне сервера при включенной интеграции с сервисом редактирования документов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить Blind SSRF-атаку...
EUVD-2021-21986
Malware in sbrugna...
EUVD-2021-19511
Malware in sbrugna...
EUVD-2021-30380
Malicious code in bioql PyPI...
EUVD-2023-32647
Malicious code in bioql PyPI...
EUVD-2023-41426
Malicious code in bioql PyPI...
EUVD-2022-3456
Malicious code in bioql PyPI...
EUVD-2023-1787
Malicious code in bioql PyPI...
Cross-site Scripting (XSS)
org.xwiki.rendering:xwiki-rendering-syntax-xhtml is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the XHTML syntax relying on the xdom+xml/current syntax, which allows insertion of arbitrary HTML including JavaScript, enabling XSS for users with document editing rights...
CVE-2025-53835: Improper Neutralization of Input During Web Page Generation
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the xdom+xml/current syntax which allows the creation of raw blocks...