Skip to content
OpenAdvisories

Vendor

MyComplianceOffice

8 known vulnerabilities.

MyComplianceOffice at a glance

Last 12 months
8
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 8 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202680
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

MCO 8
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 5.3
    CVE-2026-53909

    Arbitrary File Upload in MCO

    MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor …

    MyComplianceOffice MCO
  • Medium 6.9
    CVE-2026-53908

    User Enumeration in MCO

    MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differen…

    MyComplianceOffice MCO
  • Medium 4.8
    CVE-2026-53907

    Stored Cross‑Site Scripting in MCO

    MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo…

    MyComplianceOffice MCO
  • Medium 5.1
    CVE-2026-53906

    Path Disclosure and Path Traversal in MCO

    MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute serv…

    MyComplianceOffice MCO
  • Medium 5.3
    CVE-2026-53905

    Unauthorized Access to Administrator ACL View in MCO

    MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorizatio…

    MyComplianceOffice MCO
  • Medium 6.3
    CVE-2026-53904

    Account Denial of Service in MCO

    MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are n…

    MyComplianceOffice MCO
  • Medium 5.3
    CVE-2026-53903

    Insecure Direct Object Reference in MCO

    MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a r…

    MyComplianceOffice MCO
  • High 7.1
    CVE-2026-53902

    Privilege Escalation in MCO

    MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An a…

    MyComplianceOffice MCO