Approved changes feed: RSS · Atom
cpe:2.3:a:zmister2016:mrdoc:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Zmister2016 (e153c2ec-253c-5fd0-b332-0104476e8113) |
|---|---|
| Product | Mrdoc (ba1512ca-0673-5238-ab5c-7d832685e1a8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111645 |
vulnerable | 2026-11-03 10:16:11.641378 |
MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
MEDIUM (5.4)
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
Published: 2026-10-16T17:39:14.432Z
Updated: 2026-10-19T13:13:46.523Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-117563 |
vulnerable | 2026-11-03 10:15:34.360080 |
MrDoc through 1.1.1 Broken Access Control via manage_doc_share
MEDIUM (5.4)
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.
Published: 2026-10-27T13:07:57.656Z
Updated: 2026-11-02T19:15:30.217Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.