CVE-2025-68935
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
XSS vulnerability in ONLYOFFICE Docs before 9.2.1, present in the Font field of the Multilevel list settings window. This is related to DocumentServer.
Risk Assessment
An attacker can inject malicious script, potentially leading to session theft or account takeover in the application.
Recommendation
Update ONLYOFFICE Docs to version 9.2.1 or later to mitigate the vulnerability.
Other vulnerabilities in ONLYOFFICE Docs
See all- CVE-2025-68936Medium
ONLYOFFICE Docs before version 9.2.1 contains an XSS vulnerability related to the Color theme name, which may allow injection of malicious script.
- CVE-2025-68917Medium
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
Original NVD description (English source)
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS