42 matches found
CVE-2025-45250
CVE-2025-45250 Suggested description MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie User-Agent: Mozilla/5.0 Windows NT...
CVE-2025-45250
CVE-2025-45250 Suggested description MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie User-Agent: Mozilla/5.0 Windows NT...
CVE-2026-117563
MrDoc through 1.1.1 contains a broken access control vulnerability in the managedocshare type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID...
CVE-2026-117563
MrDoc through 1.1.1 contains a broken access control vulnerability in the managedocshare type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID...
CVE-2026-117563 MrDoc through 1.1.1 Broken Access Control via manage_doc_share
MrDoc through 1.1.1 contains a broken access control vulnerability in the managedocshare type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID...
EUVD-2026-110841
MrDoc through 1.1.1 contains a broken access control vulnerability in the managedocshare type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID...
CVE-2026-117563
The MrDoc application (versions through 1.1.1) is affected by a broken access control vulnerability in the manage_doc_share type 3 branch. The root cause is a missing ownership check during updates, which allows authenticated users to modify the document share settings of other users. Attackers c...
CVE-2026-117563 MrDoc through 1.1.1 Broken Access Control via manage_doc_share
MrDoc through 1.1.1 contains a broken access control vulnerability in the managedocshare type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID...
PT-2026-126422
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage doc share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ...
CVE-2026-111645
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...
CVE-2026-111645
The MrDoc software (versions through 1.1.1 ) is vulnerable to a missing object-level authorization flaw in the api/import_local_doc/ endpoint. This vulnerability allows authenticated users to perform unauthorized actions on other users' documents and projects. Specifically, an attacker can use PU...
CVE-2026-111645
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...
EUVD-2026-103067
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...
CVE-2026-111645 MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...
CVE-2026-111645 MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...
CVE-2026-111645 MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...
CVE-2026-111645: Authorization Bypass Through User-Controlled Key
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...
PT-2026-116044
🚨 CVE-2026-111645 MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort data document ids to publish private draft...
zmister2016 MrDoc Authorization Issue Vulnerability
zmister2016 MrDoc versions 1.1.1 and earlier have an authorization issue. This vulnerability stems from the lack of object-level authorization in the ImportLocalDoc API. It may allow authenticated users to modify other users’ documents and projects by sending PUT requests containing arbitrary...