GCVE - cpe:2.3:a:onlyoffice:document_server:5.5.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:onlyoffice:document_server:5.5.0:*:*:*:*:*:*:*

part: a version: 5.5.0 update: *

Vendor	Onlyoffice (`aa7cc050-0dc3-5b16-8f30-50874a0ca7d2`)
Product	Document Server (`98959d25-6982-5419-9a75-714317655e7f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/onlyoffice/documentserver`	purl2cpe	2026-06-01 10:18:00.395335

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-11537`	vulnerable	2026-06-08 05:16:47.380674	Details available A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API. Published: 2020-04-15T14:56:05.000Z Updated: 2024-08-04T11:35:13.463Z Open on db.gcve.eu Reference links https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551 https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-11536`	vulnerable	2026-06-08 05:16:47.380287	Details available An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server. Published: 2020-04-15T14:56:10.000Z Updated: 2024-08-04T11:35:13.019Z Open on db.gcve.eu Reference links https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551 https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-11535`	vulnerable	2026-06-08 05:16:47.379880	Details available An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server. Published: 2020-04-15T14:56:21.000Z Updated: 2024-08-04T11:35:12.979Z Open on db.gcve.eu Reference links https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551 https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-11534`	vulnerable	2026-06-08 05:16:47.379360	Details available An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary (such as curl or wget) and remotely execute code on a victim's server. Published: 2020-04-15T14:56:35.000Z Updated: 2024-08-04T11:35:13.031Z Open on db.gcve.eu Reference links https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551 https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.