465 matches found
Information Disclosure
ShowDoc/ShowDoc is vulnerable to information disclosure. The library does not properly configure it's access controls by default, allowing a malicious user to use the pageid variable in the URL to gain access to sensitive information...
ShowDoc Cross-Site Request Forgery Vulnerability
ShowDoc is an online document sharing tool. A cross-site request forgery vulnerability exists in server/index.php?s=/api/teamMember/save URL in ShowDoc version 2.4.2. A remote attacker can exploit this vulnerability to add a new user to a team...
ShowDoc Annotation Editing Vulnerability
ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. A remote attacker can exploit the vulnerability to modify a user's notes with a modified 'pageid' parameter...
ShowDoc Information Disclosure Vulnerability
ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. The vulnerability can be exploited by a remote attacker to obtain sensitive information via the modified 'pageid' parameter...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
Code injection
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
CVE-2018-19609 affects ShowDoc 2.4.1. The issue lets remote attackers disclose sensitive data by supplying a modified page_id, enabling reads of note content or discovery of usernames in JSON data at a different URL. Publicly documented details across multiple sources confirm the vulnerability is...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
Cross-site Scripting (XSS)
showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of lang parameter, allowing XSS attacks...
CVE-2018-19433
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...
CVE-2018-19433
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...
Design/Logic Flaw
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...
CVE-2018-19433
CVE-2018-19433 affects ShowDoc 2.4.1, with an XSS vulnerability stemming from incorrect handling of the $cur_lang value in install/database.php (lang parameter). Public sources (NVD, OSV, CVE lists) describe the issue and classify it as a Cross-Site Scripting risk, but none of the connected docum...
CVE-2018-19433
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...
ShowDoc cross-site scripting vulnerability (CNVD-2018-24180)
ShowDoc is an online document sharing tool. A cross-site scripting vulnerability exists in ShowDoc version 2.4.1, which stems from the failure of the install/database.php file to correctly handle the value of $curlang, which can be exploited by remote attackers to inject arbitrary Web script or...
ShowDoc Cross-Site Scripting Vulnerability
ShowDoc is an online document sharing tool. A cross-site scripting vulnerability exists in ShowDoc version 1.8.0, which can be exploited by remote attackers to inject arbitrary web script or HTML via a newly created page...
Cross-site Scripting (XSS)
showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of html tags, allowing arbitrary html to be decoded, causing XSS attacks...