OnlyOffice vulnerabilities
10 published CVEs name OnlyOffice among the affected products.
- 10Published CVEs10 of them scored
- 5Last 12 monthspublished in the last year
- 1Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-110652
ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass
ONLYOFFICE · DocumentServer
Medium6.3 - CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to…
ONLYOFFICE · Document Server
High8.7 - CVE-2025-68936
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
ONLYOFFICE · Document Server
Medium6.4 - CVE-2025-68935
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
ONLYOFFICE · Document Server
Medium6.4 - CVE-2025-68917
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
ONLYOFFICE · Document Server
Medium6.4 - CVE-2025-6380
ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function
onlyoffice · ONLYOFFICE Docs
Critical9.8 - CVE-2025-5301
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
OnlyOffice · Docs (DocumentServer)
Medium6.1 - CVE-2024-11750
ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
onlyoffice · ONLYOFFICE DocSpace
Medium6.4 - CVE-2024-11450
ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
onlyoffice · ONLYOFFICE Docs
Medium6.4 - CVE-2022-47412
ONLYOFFICE Workspace Search Stored XSS
ONLYOFFICE · Workspace
Medium5.4