Skip to content
OpenAdvisories

Vendor

ONLYOFFICE

10 known vulnerabilities.

Products

Document Server 4 ONLYOFFICE Docs 2 DocumentServer 1 Docs (DocumentServer) 1 Workspace 1 ONLYOFFICE DocSpace 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2025-6380

    ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function

    The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment…

    ONLYOFFICE ONLYOFFICE Docs Web / CMS