Skip to content
OpenAdvisories

Product · ONLYOFFICE

Docs (DocumentServer)

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2025-5301 EPSS 63%

    Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

    ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then r…

    ONLYOFFICE Docs (DocumentServer)