Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 46

Export CSV
CVE-2026-120203

ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2026-119661

ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Showdoc Star7th
Products
Showdoc Showdoc
CVE-2026-86644

star7th showdoc API Page Save Endpoint editormd.js cross site scripting

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc Star7th
Products
Showdoc Showdoc
CVE-2026-6982

star7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injection

A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the component API Page Sort Endpoint. Executing a manipulation of the argument pages can lead to sql injection. The attack may be launched remotely. Upgrading to version 3.8.1 addresses this issue. It is suggested to upgrade the affected component. According to the researcher, "[t]he vendor explicitly stated they will not backport patches to the older affected versions."

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc Star7th
Products
Showdoc Showdoc
CVE-2025-0520

ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

CVSS 4.0 · 9.4 Critical EPSS 2.4% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-1034

There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc

There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0967

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS 3.3% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0966

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc

Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0965

Stored XSS viva .ofd file upload in star7th/showdoc

Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0964

Stored XSS viva .webmv file upload in star7th/showdoc

Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0962

Stored XSS viva .webma file upload in star7th/showdoc

Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0960

Stored XSS viva .properties file upload in star7th/showdoc

Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0957

Stored XSS via File Upload in star7th/showdoc

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0956

Stored XSS via File Upload in star7th/showdoc

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0951

File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc

File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0950

Unrestricted Upload of File with Dangerous Type in star7th/showdoc

Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0946

Stored XSS viva cshtm file upload in star7th/showdoc

Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0945

Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc

Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0942

Stored XSS due to Unrestricted File Upload in star7th/showdoc

Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0941

Stored XSS due to Unrestricted File Upload in star7th/showdoc

Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc