CVE-2018-19433

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

ShowDoc cross-site scripting vulnerability (CNVD-2018-24180)

ShowDoc is an online document sharing tool. A cross-site scripting vulnerability exists in ShowDoc version 2.4.1, which stems from the failure of the install/database.php file to correctly handle the value of $curlang, which can be exploited by remote attackers to inject arbitrary Web script or...

ShowDoc Cross-Site Scripting Vulnerability

ShowDoc is an online document sharing tool. A cross-site scripting vulnerability exists in ShowDoc version 1.8.0, which can be exploited by remote attackers to inject arbitrary web script or HTML via a newly created page...

Cross-site Scripting (XSS)

showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of html tags, allowing arbitrary html to be decoded, causing XSS attacks...

Design/Logic Flaw

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

CVE-2018-16342

ShowDoc v1.8.0 is affected by a cross-site scripting (XSS) vulnerability via a newly created page. The issue allows injection of arbitrary web script or HTML (as per CNVD/related advisories) and is associated with ShowDoc 1.8.0. The connected documents confirm the vulnerability existence and affe...

CVE-2018-16342

ShowDoc v1.8.0 has XSS via a new page...

ShowDoc v1.8.0 suffers from stored xss vulnerability

ShowDoc is an online document sharing tool that speeds up communication between teams. A stored xss vulnerability exists in ShowDoc v1.8.0 and below, which stems from a failure to filter harmful tags and allows an attacker to obtain a user cookie via an img tag...

File Upload Vulnerability in ShowDoc System

ShowDoc is an online document sharing tool for IT teams. A file upload vulnerability exists in the ShowDoc system. The vulnerability is due to the system failing to check the suffix type of the image upload function, an attacker can use the vulnerability to upload arbitrary files and gain server...