CVE-2025-68936

MEDIUM6.4Cross-site scripting

JSON export Create alert

Description

ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

ONLYOFFICE / Document Server0 – 9.2.1
ONLYOFFICE / Document Server9.2.1

References

MISChttps://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921

Updated 45m ago · 8 sources