114 matches found
OnlyOffice-path-traversal
ONLYOFFICE Path Traversal Exploit CVE-2023-46988 📌 Overview This script exploits a path traversal vulnerability in ONLYOFFICE Document Server CVE-2023-46988 that allows unauthorized users to copy arbitrary files from the server. The vulnerability exists in the /example/editor endpoint, where the...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
EUVD-2026-100761
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-110385
The ONLYOFFICE Document Server (versions before 10.0.0 ) is vulnerable to remote code execution via a flaw in the Document Builder API . An authenticated attacker possessing a valid Inbox-compatible JWT can provide user-controlled converter XML through the optional third argument of builder.SaveF...
CVE-2026-110385: External Control of File Name or Path
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-93643
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
EUVD-2026-87101
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
CVE-2026-93643: Improper Limitation of a Pathname to a Restricted Directory
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
PT-2026-98865
Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing affected versions not specified Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the...
EUVD-2020-3888
Malware in sbrugna...
EUVD-2020-3887
Malware in sbrugna...
EUVD-2020-3889
Malware in sbrugna...
EUVD-2020-3886
Malware in sbrugna...
EUVD-2021-26539
Malware in sbrugna...
EUVD-2022-29136
Malicious code in bioql PyPI...
EUVD-2021-28020
Malicious code in bioql PyPI...
