documentcloud vulnerabilities

Products

• karteek-docsplit 1
• navis documentcloud 1

Latest documentcloud CVEs

Newest publication first

1. CVE-2015-2807 Navis DocumentCloud < 0.1.1 - Reflected Cross-Site Scripting

   Published 2015-09-01

   Medium·CVSS 4.3

   Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.

2. CVE-2013-1933 Karteek Docsplit vulnerable to OS Command Injection

   Published 2013-04-25

   High·CVSS 9.3 PoC

   The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.