1. Home
  2. CVE Database
  3. CVE-2025-68936
MEDIUM · 6.4

CVE-2025-68936

ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.

Vulnerability Description

ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.

CVSS Score

6.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
OnlyofficeDocument Server< 9.2.1

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2025-68936?

CVE-2025-68936 is a vulnerability with a CVSS score of 6.4 (MEDIUM). ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.

How severe is CVE-2025-68936?

CVE-2025-68936 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-68936?

Check the references section above for vendor advisories and patch information. Affected products include: Onlyoffice Document Server.