Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 46

Export CSV
CVE-2021-36440

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2018-19621

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2018-19620

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.

CVSS 3.0 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2018-19609

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2018-19433

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc