Onlyoffice Docs vulnerabilities

• onlyoffice docs ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function CVE-2025-6380 9.8 CriticalJuly 24, 2025
• onlyoffice docs (documentserver) Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer) CVE-2025-5301 EPSS 62.4% 6.1 MediumJune 12, 2025
• onlyoffice docspace ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11750 6.4 MediumDecember 12, 2024
• onlyoffice docs ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-11450 6.4 MediumDecember 6, 2024
• onlyoffice docs, onlyoffice +1 more ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro.... CVE-2024-44085 6.1 MediumSeptember 9, 2024
• onlyoffice docs, document server +1 more ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function... CVE-2023-50883 6.1 MediumSeptember 9, 2024
• onlyoffice document server, docs +1 more Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server... CVE-2021-3199 In KEV EPSS 30.2% 9.8 CriticalJanuary 22, 2021