CVE-2026-71234

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234 Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a secure query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stor...

CVE-2026-71234

Documize Community exposes an authentication bypass in the attachment download endpoint: the Download function accepts a non-empty secure query parameter and grants access without validating against a server-stored value. This is inconsistent with sibling handlers (togglePublish, delete) which en...

CVE-2026-71234 Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234: Incorrect Authorization

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

PT-2026-68100

Name of the Vulnerable Software and Affected Versions Documize Community affected versions not specified Description An authorization bypass exists in the attachment download route. The Download function, located in domain/attachment/endpoint.go, accepts a secure query parameter but only verifies...

EUVD-2021-1222

Malware in sbrugna...

CVE-2023-23634

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

CVE-2019-19619

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS...

CVE-2023-23634

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

CVE-2023-23634

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

Sql injection

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

Documize Security Breach

Documize is an open source document collaboration system built on Golang and EmberJS. A security vulnerability exists in Documize version 5.4.2, which stems from an SQL injection vulnerability. The vulnerability allows remote attackers to execute arbitrary code via user parameters in the...

CVE-2023-23634

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

CVE-2023-23634

CVE-2023-23634 affects Documize 5.4.2. A SQL injection vulnerability in the /api/dashboard/activity endpoint allows remote attackers to execute arbitrary code via the user parameter, with high impact (C, I, A all High) and CVSS 3.1 score 9.8. Affected component: the /api/dashboard/activity reques...

CVE-2023-23634: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

PT-2023-19094 · Documize · Documize

Name of the Vulnerable Software and Affected Versions: Documize version 5.4.2 Description: The issue allows remote attackers to execute arbitrary code via the user parameter of the "/api/dashboard/activity" endpoint. This enables attackers to potentially gain unauthorized access and control over...

Cross-site Scripting in Documize

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS...

GHSA-WMWP-PGGC-H4MJ Cross-site Scripting in Documize

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS...