cve.bz

zmister2016 mrdoc vulnerabilities in 2026, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 5.3CVE-2026-125375EPSS 0.3%

    MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data.…

  2. 5.3CVE-2026-120427EPSS 0.3%

    MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retriev…

  3. 5.3CVE-2026-117563EPSS 0.2%

    MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can …

  4. 5.3CVE-2026-111645EPSS 0.3%

    MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_da…