Priority MEDIUM 40
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00352 · Published 2026-10-31 · Fixed in 3.9.6 CWE-94
Priority LOW 12
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00379 · Published 2026-10-30 · No fix listed CWE-639
Priority MEDIUM 56
A vulnerability was determined in star7th showdoc up to 3.9.1.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00365 · Published 2026-09-08 · Fixed in 3.9.2 CWE-79
Priority LOW 24
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00241 · Published 2026-04-25 · Fixed in 3.8.1 CWE-74
Priority HIGH 76
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.02445 · Published 2025-04-29 · Fixed in 2.8.7 CWE-434
Priority LOW 35
There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01481 · Published 2022-03-22 · Fixed in 2.10.4 CWE-434
Priority LOW 26
Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00838 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 26
Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00902 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 25
Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00541 · Published 2022-03-15 · Fixed in 2.4.10, 2.10.4 CWE-79
Priority LOW 30
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.03262 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 26
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00752 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 26
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00766 · Published 2022-03-15 · Fixed in 2.10.4 CWE-79
Priority LOW 26
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00736 · Published 2022-03-15 · Fixed in v.2.10.4, 2.10.4 CWE-79
Priority LOW 29
File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00884 · Published 2022-03-15 · Fixed in 2.10.4 CWE-434
Priority LOW 25
Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00634 · Published 2022-03-15 · Fixed in 2.10.4 CWE-434
Priority LOW 26
Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00809 · Published 2022-03-15 · Fixed in v2.10.4, 2.10.4 CWE-434
Priority LOW 26
Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00902 · Published 2022-03-14 · Fixed in 2.10.4 CWE-434
Priority LOW 26
Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00853 · Published 2022-03-14 · Fixed in 2.10.4 CWE-434
Priority LOW 26
Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00819 · Published 2022-03-14 · Fixed in v2.10.4, 2.10.4 CWE-79
Priority LOW 25
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00619 · Published 2022-03-14 · Fixed in v2.10.4, 2.10.4 CWE-79
Priority LOW 25
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00547 · Published 2022-03-14 · Fixed in v2.10.4, 2.10.4 CWE-79
Priority LOW 25
Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00641 · Published 2022-03-14 · Fixed in v2.10.4, 2.10.4 CWE-79
Priority LOW 25
Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00547 · Published 2022-03-14 · Fixed in 2.10.4 CWE-79
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00743 · Published 2022-03-12 · Fixed in 2.10.2, 2.10.4 CWE-79
Priority LOW 36
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00942 · Published 2022-02-19 · Fixed in 2.10.2 CWE-434
Load more
THREATIST.IORead the docs