Priority HIGH 76
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.02445 · Published 2025-04-29 · Fixed in 2.8.7 CWE-434
Priority MEDIUM 56
A vulnerability was determined in star7th showdoc up to 3.9.1.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00365 · Published 2026-09-08 · Fixed in 3.9.2 CWE-79
Priority MEDIUM 50
Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04762 · Published 2021-09-08 · Fixed in 2.9.6 CWE-434
Priority MEDIUM 45
SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01467 · Published 2022-01-26 · Fixed in 2.10.3 CWE-89
Priority MEDIUM 45
ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0139 · Published 2021-10-22 · Fixed in 2.8.5 CWE-434
Priority MEDIUM 40
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00352 · Published 2026-10-31 · Fixed in 3.9.6 CWE-94
Priority LOW 39
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00634 · Published 2021-12-26 · Fixed in 2.9.15 CWE-352
Priority LOW 39
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00616 · Published 2021-12-01 · Fixed in v2.9.13, 2.9.13 CWE-352
Priority LOW 36
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00942 · Published 2022-02-19 · Fixed in 2.10.2 CWE-434
Priority LOW 35
There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01481 · Published 2022-03-22 · Fixed in 2.10.4 CWE-434
Priority LOW 31
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00891 · Published 2021-12-01 · Fixed in 2.9.13 CWE-338
Priority LOW 31
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01197 · Published 2018-11-27 · No fix listed CWE-200
Priority LOW 30
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.03262 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 29
File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00884 · Published 2022-03-15 · Fixed in 2.10.4 CWE-434
Priority LOW 29
showdoc is vulnerable to URL Redirection to Untrusted Site
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00849 · Published 2021-12-03 · Fixed in 2.9.13 CWE-601
Priority LOW 29
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00522 · Published 2021-12-01 · Fixed in v2.9.13, 2.9.13 CWE-352
Priority LOW 29
showdoc is vulnerable to URL Redirection to Untrusted Site
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00786 · Published 2021-12-01 · Fixed in 2.9.13 CWE-601
Priority LOW 29
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00411 · Published 2021-11-13 · No fix listed CWE-352
Priority LOW 29
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01064 · Published 2021-08-04 · Fixed in 2.9.8 CWE-338
Priority LOW 29
server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00447 · Published 2018-11-28 · No fix listed CWE-352
Priority LOW 29
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2018-11-22 · No fix listed CWE-79
Priority LOW 26
Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00902 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 26
Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00838 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 26
Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00902 · Published 2022-03-14 · Fixed in 2.10.4 CWE-434
Priority LOW 26
Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00853 · Published 2022-03-14 · Fixed in 2.10.4 CWE-434
Load more
THREATIST.IORead the docs