Skip to content
Onlyoffice vulnerabilities
Newest
-
onlyoffice documentserver
ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass
CVE-2026-110652
6.3 Medium
-
onlyoffice document server
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows...
CVE-2026-110385
8.7 High
-
onlyoffice document server
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
CVE-2025-68936
6.4 Medium
-
onlyoffice document server
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings...
CVE-2025-68935
6.4 Medium
-
onlyoffice document server
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is...
CVE-2025-68917
6.4 Medium
-
onlyoffice docs
ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function
CVE-2025-6380
9.8 Critical
-
onlyoffice docs (documentserver)
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
CVE-2025-5301
EPSS 62.4%
6.1 Medium
-
onlyoffice document server
Directory Traversal vulnerability in ONLYOFFICE Document Server v.7.5.0 and before allows a...
CVE-2023-46988
Public exploit
6.7 Medium
-
onlyoffice docspace
ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-11750
6.4 Medium
-
onlyoffice docs
ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-11450
6.4 Medium
-
onlyoffice docs, onlyoffice +1 more
ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro....
CVE-2024-44085
6.1 Medium
-
onlyoffice docs, document server +1 more
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function...
CVE-2023-50883
6.1 Medium
-
onlyoffice document server
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote...
CVE-2023-30188
7.5 High
-
onlyoffice document server
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2...
CVE-2023-30187
9.8 Critical
-
onlyoffice document server
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote...
CVE-2023-30186
9.8 Critical
-
onlyoffice
Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE...
CVE-2023-34939
9.8 Critical
-
onlyoffice document server
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges...
CVE-2022-48422
7.8 High
-
citrix workspace
ONLYOFFICE Workspace Search Stored XSS
CVE-2022-47412
5.4 Medium
-
onlyoffice server
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The...
CVE-2021-43449
8.1 High
-
onlyoffice server
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of...
CVE-2021-43448
5.3 Medium
-
onlyoffice server
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An...
CVE-2021-43447
7.5 High
-
onlyoffice server
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros...
CVE-2021-43446
6.1 Medium
-
onlyoffice server
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can...
CVE-2021-43445
9.8 Critical
-
onlyoffice server
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document...
CVE-2021-43444
7.5 High
-
onlyoffice core, document server +1 more
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to...
CVE-2022-29777
9.8 Critical
-
onlyoffice core, document server +1 more
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to...
CVE-2022-29776
9.8 Critical
-
onlyoffice document server
A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0...
CVE-2022-24229
6.1 Medium
-
onlyoffice google translate
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks...
CVE-2021-40864
9.8 Critical
-
onlyoffice document server
12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
CVE-2021-25833
EPSS 43.5%
9.8 Critical
-
onlyoffice document server
A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of...
CVE-2021-25832
EPSS 12.6%
9.8 Critical
-
onlyoffice document server
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9...
CVE-2021-25831
EPSS 11.5%
9.8 Critical
-
onlyoffice document server
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0...
CVE-2021-25830
EPSS 11.8%
9.8 Critical
-
onlyoffice document server
An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE...
CVE-2021-25829
7.5 High
-
onlyoffice document server, docs +1 more
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server...
CVE-2021-3199
In KEV
EPSS 30.2%
9.8 Critical
-
onlyoffice document server
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious ...
CVE-2020-11534
9.8 Critical
-
onlyoffice document server
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious ...
CVE-2020-11535
9.8 Critical
-
onlyoffice document server
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious ...
CVE-2020-11536
9.8 Critical
-
onlyoffice document server
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute...
CVE-2020-11537
9.8 Critical