Vulnerabilities

TI-2026-49905 CVE-2026-71234 · GHSA-4gcg-395p-mg6g

Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

LOW 39

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is si…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2026-08-05 No fix listed CWE-863

TI-2023-09462 CVE-2023-23634 · GHSA-mj7q-7phw-qxj9

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute…

MEDIUM 44

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01094 Published 2023-12-29 No fix listed CWE-89

TI-2019-14138 CVE-2019-19619 · GHSA-wmwp-pggc-h4mj

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted…

LOW 30

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01245 Published 2019-12-06 Fixed in 3.5.1 CWE-79

Vulnerabilities

Filters

Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute…

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted…