ONLYOFFICE

Records38All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical17CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

ONLYOFFICE records in CISA KEV

TI-2021-02273 ONLYOFFICE Docs Server Path Traversal Vulnerability CRITICAL 100KEV 2026-10-08

Components

Products in the NVD configurations · select one to filter the records

Document Server 21 records CRITICAL Server 6 records HIGH Core 2 records MEDIUM Onlyoffice 2 records HIGH Google Translate 1 record MEDIUM Workspace 1 record MEDIUM

Records

2 records in Onlyoffice · all components

TI-2023-17445 CVE-2023-34939 · GHSA-8rx2-c38v-6hm8

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code…

HIGH 82

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05033 Published 2023-06-22 No fix listed CWE-22

TI-2024-29666 CVE-2024-44085 · GHSA-54cp-27ww-4fm3

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a…

MEDIUM 60

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00526 Published 2024-09-09 No fix listed CWE-79

Open these records in search →

Critical	17
High	7
Medium	14
Low	0
No CVSS	0