Vulnerabilities

TI-2025-39423 CVE-2025-63695 · GHSA-4qjp-r564-vfh5

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.

HIGH 82

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0042 Published 2025-11-18 No fix listed CWE-434

TI-2025-39422 CVE-2025-63694 · GHSA-6wj2-ghg5-xj2p

DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.

HIGH 82

DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00376 Published 2025-11-18 No fix listed CWE-89

TI-2025-39421 CVE-2025-63693 · GHSA-5472-qhvw-4r4w

The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x…

LOW 24

The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0019 Published 2025-11-18 No fix listed CWE-94

TI-2024-27617 CVE-2024-41376 · GHSA-8694-9wwj-rvph

dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.

HIGH 73

dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00959 Published 2024-08-05 No fix listed CWE-31

TI-2024-19415 CVE-2024-29273 · GHSA-35j4-3hfm-6mj2

There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to…

MEDIUM 60

There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00366 Published 2024-03-22 No fix listed CWE-79

TI-2023-20804 CVE-2023-39853 · GHSA-5x7g-8gcq-4xxf

SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain…

MEDIUM 62

SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00744 Published 2024-01-06 No fix listed CWE-89

TI-2021-10738 CVE-2021-30205 · GHSA-f8j8-g2f7-722j

Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice…

MEDIUM 63

Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments and usernames.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00515 Published 2023-06-27 No fix listed CWE-863

TI-2021-10737 CVE-2021-30203 · GHSA-4wgc-vg4p-9q74

A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice…

MEDIUM 60

A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00596 Published 2023-06-27 No fix listed CWE-79

TI-2022-21159 CVE-2022-43340 · GHSA-gjm6-3c4q-m6rg

A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to…

HIGH 71

A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00489 Published 2022-10-27 No fix listed CWE-352

TI-2021-19509 CVE-2021-43673 · GHSA-32rx-f52q-fcwp

dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in…

LOW 28

dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2021-12-03 No fix listed CWE-79

TI-2021-17391 CVE-2021-40292 · GHSA-8wq9-gxc4-xcpv

A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.

LOW 25

A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2021-10-12 No fix listed CWE-79

TI-2021-17363 CVE-2021-40191 · GHSA-2cwh-9m9v-957f

Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of…

LOW 25

Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Uploader.class.php and return a wrong response in content-type…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00503 Published 2021-10-11 No fix listed CWE-79

TI-2020-13682 CVE-2020-19703 · GHSA-25hh-342h-jw88

A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02…

LOW 28

A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2021-08-26 No fix listed CWE-79

TI-2021-02321 CVE-2021-3318 · GHSA-jj2f-926m-w2rc

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.

LOW 33

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02883 Published 2021-01-27 No fix listed CWE-79

Vulnerabilities

Filters