PT-2018-15020

Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.1 Description The issue allows remote attackers to obtain sensitive information by navigating with a modified page id. This can be demonstrated by reading note content or discovering a username in the JSON data at a diff UR...

CVE-2018-19609: Exposure of Sensitive Information to an Unauthorized Actor

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...

Cross-site Scripting (XSS)

showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of lang parameter, allowing XSS attacks...

CVE-2018-19433

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

CVE-2018-19433

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

Design/Logic Flaw

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

CVE-2018-19433

CVE-2018-19433 affects ShowDoc 2.4.1, with an XSS vulnerability stemming from incorrect handling of the $cur_lang value in install/database.php (lang parameter). Public sources (NVD, OSV, CVE lists) describe the issue and classify it as a Cross-Site Scripting risk, but none of the connected docum...

CVE-2018-19433

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

CVE-2018-19433: Improper Neutralization of Input During Web Page Generation

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

ShowDoc cross-site scripting vulnerability (CNVD-2018-24180)

ShowDoc is an online document sharing tool. A cross-site scripting vulnerability exists in ShowDoc version 2.4.1, which stems from the failure of the install/database.php file to correctly handle the value of $curlang, which can be exploited by remote attackers to inject arbitrary Web script or...

PT-2018-14959

Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.1 Description The issue arises from the mishandling of the $cur lang value in the install/database.php file, leading to a potential XSS attack via the lang parameter. Recommendations For ShowDoc version 2.4.1, avoid using t...

ShowDoc Cross-Site Scripting Vulnerability

ShowDoc is an online document sharing tool. A cross-site scripting vulnerability exists in ShowDoc version 1.8.0, which can be exploited by remote attackers to inject arbitrary web script or HTML via a newly created page...

Cross-site Scripting (XSS)

showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of html tags, allowing arbitrary html to be decoded, causing XSS attacks...

Design/Logic Flaw

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 is affected by a cross-site scripting (XSS) vulnerability via a newly created page. The issue allows injection of arbitrary web script or HTML (as per CNVD/related advisories) and is associated with ShowDoc 1.8.0. The connected documents confirm the vulnerability existence and affe...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

ShowDoc v1.8.0 suffers from stored xss vulnerability

ShowDoc is an online document sharing tool that speeds up communication between teams. A stored xss vulnerability exists in ShowDoc v1.8.0 and below, which stems from a failure to filter harmful tags and allows an attacker to obtain a user cookie via an img tag...

File Upload Vulnerability in ShowDoc System

ShowDoc is an online document sharing tool for IT teams. A file upload vulnerability exists in the ShowDoc system. The vulnerability is due to the system failing to check the suffix type of the image upload function, an attacker can use the vulnerability to upload arbitrary files and gain server...