CVE-2025-68935

MEDIUM6.4Cross-site scripting

JSON export Create alert

Description

ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

ONLYOFFICE / Document Server0 – 9.2.1
ONLYOFFICE / Document Server9.2.1

References

MISChttps://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921

Updated 44m ago · 8 sources