CVE-2022-0967

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc

6.9 MediumPublic exploitFix available

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.26%Up 2.4 points since Mar 16, 2022

What each source reports

CVE List Score used 6.9

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

Record: CVE-2022-0967
CVSS 3.0: 6.9 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-1291 6.9

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

Record: EUVD-2022-1291
CVSS 3.0: 6.9 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3pg8-c473-w6rr 6.9

Stored Cross-site Scripting in showdoc

ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.

Record: GHSA-3pg8-c473-w6rr
CVSS 3.0: 6.9 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.4

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

Record: CVE-2022-0967
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0: 6.9 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.9

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

Record: CVE-2022-0967
CVSS 3.0: 6.9 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-3pg8-c473-w6rr 6.9

Stored Cross-site Scripting in showdoc

Record: GHSA-3pg8-c473-w6rr
CVSS 3.0: 6.9 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`showdoc/showdoc` Packagist	before 2.10.4	2.10.4
`showdoc/showdoc` Packagist	before 2.10.4, plus listed versions v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4 Show 45 moreShow less v1.0.5v1.1.0v1.1.1v1.1.3v1.1.4v1.1.5v1.2.0v1.2.1v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.3.0v1.3.1v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4v1.4.5v1.4.6v1.4.7v1.5.0v1.5.1v1.5.2v1.5.3v1.6.0v1.6.1v1.6.2v1.7.0v1.7.1v1.7.2v1.8.0v1.8.1v1.8.2v1.8.3v1.8.4v1.8.5	2.10.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)	2022-05-17

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-0967 is a medium vulnerability (CVSS 6.9) in Showdoc, published March 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.26%, the 88th percentile. Fixed in showdoc/showdoc 2.10.4.

References

This page doesn't list everything

Left out here: 87 versions. The JSON record has them.