Threat database

5 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.4%	CVE-2025-63695dzzoffice · n/a Critical9.8EPSS 0.4%2025-11-18CVE Database V5CVE-2025-63695 DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php. EPSS 0.4%Vulnerability	CVE Database V5	2025-11-18
Medium	5.4	EPSS 0.2%	CVE-2025-63693dzzoffice · n/a Medium5.4EPSS 0.2%2025-11-18CVE Database V5CVE-2025-63693 The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up. EPSS 0.2%Vulnerability	CVE Database V5	2025-11-18
Critical	9.8	EPSS 0.4%	CVE-2025-63694dzzoffice · n/a Critical9.8EPSS 0.4%2025-11-18CVE Database V5CVE-2025-63694 DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage. EPSS 0.4%Vulnerability	CVE Database V5	2025-11-18
High	8.8	EPSS 1.0%	CVE-2024-41376dzzoffice · n/a High8.8EPSS 1.0%2024-08-05CVE Database V5CVE-2024-41376 dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php. EPSS 1.0%Vulnerability	CVE Database V5	2024-08-05
Medium	6.1	EPSS 0.4%	CVE-2024-29273dzzoffice · n/a Medium6.1EPSS 0.4%2024-03-22CVE Database V5CVE-2024-29273 There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document. EPSS 0.4%Vulnerability	CVE Database V5	2024-03-22

Page 1 of 1