CVE-2025-68936
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
ONLYOFFICE Docs before version 9.2.1 contains an XSS vulnerability related to the Color theme name, which may allow injection of malicious script.
Risk Assessment
An attacker can exploit this vulnerability to execute scripts in the context of the user's browser, potentially leading to data theft or session hijacking.
Recommendation
Update ONLYOFFICE Docs to version 9.2.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in ONLYOFFICE Docs
See all- CVE-2025-68935Medium
XSS vulnerability in ONLYOFFICE Docs before 9.2.1, present in the Font field of the Multilevel list settings window. This is related to DocumentServer.
- CVE-2025-68917Medium
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
Original NVD description (English source)
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS