173 matches found
OnlyOffice-path-traversal
ONLYOFFICE 路径遍历漏洞利用 CVE-2023-46988 📌 概述 该脚本利用了 ONLYOFFICE Document Server 中的一个路径遍历漏洞 （CVE-2023-46988 ），该漏洞允许未经授权的用户从服务器复制任意文件 。该漏洞存在于 /example/editor 端点，其中 fileExt 参数可以被操纵以访问敏感的系统文件和配置文件。 ⚠️ 免责声明 此工具仅用于教育和授权的安全研究目的 。 未经明确许可 对系统进行未授权使用是非法且不道德的。 🛠 功能 获取默认敏感文件 ： /etc/passwd...
CVE-2026-84282
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
CVE-2026-84282
A Server-Side Request Forgery (SSRF) vulnerability in the ONLYOFFICE ownCloud Integration plugin v9.12 (Ascensio System SIA) allows an authenticated administrator to force the ownCloud server to issue arbitrary outbound requests. The vulnerable endpoint is /apps/onlyoffice/ajax/settings/address, ...
EUVD-2026-72807
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability
Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...
CVE-2026-41034
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion via pictFmla.cbBufInCtlStm and other vectors, leading to an information leak and ASLR bypass...
CVE-2026-7314
A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function getdocpath of the file src/spiredocmcp/api/base.py. Performing a manipulation of the argument documentname results in path traversal. The attack can be initiated remotely. The exploit is now public and...
EUVD-2025-205392
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer...
EUVD-2025-205393
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer...
CVE-2025-68936
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer...
CVE-2025-68936
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer...
CVE-2025-68936
Summary: CVE-2025-68936 affects ONLYOFFICE Docs prior to 9.2.1 (DocumentServer relation) and is referenced across multiple feeds as a cross-site scripting (XSS) vulnerability. Affected software: ONLYOFFICE Docs (DocumentServer component referenced in the CVE). Vulnerability details: XSS via the C...
CVE-2025-68917
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer...
CVE-2025-68917
CVE-2025-68917 affects ONLYOFFICE Docs (DocumentServer) prior to version 9.2.1. The issue is a cross-site scripting (XSS) vulnerability in the textarea of the comment editing form. Root cause details are not elaborated beyond the XSS in the description, but multiple sources confirm the affected p...
CVE-2025-68917
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer...
EUVD-2006-1628
Malware in sbrugna...
EUVD-2020-3889
Malware in sbrugna...