Search
Search Results (4 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117563 | 1 Mrdoc | 1 Mrdoc | 2026-10-27 | 5.4 Medium |
| MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents. | ||||
| CVE-2026-111645 | 1 Mrdoc | 1 Mrdoc | 2026-10-19 | 5.4 Medium |
| MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents. | ||||
| CVE-2025-45250 | 1 Mrdoc | 1 Mrdoc | 2025-06-27 | 5.5 Medium |
| MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file. | ||||
| CVE-2021-32568 | 1 Mrdoc | 1 Mrdoc | 2024-11-21 | 7.8 High |
| mrdoc is vulnerable to Deserialization of Untrusted Data | ||||
Page 1 of 1.