Description
Ascensio System ONLYOFFICE是拉脱维亚Ascensio System公司的一款办公软件。 ONLYOFFICE 2021-11-08 之前的所有版本存在安全漏洞，该漏洞源于易受跨站点脚本 (XSS) 攻击。文档编辑器的“macros”功能允许使用恶意跨站点脚本负载。
ONLYOFFICE 跨站脚本漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://cve.imfht.com/detail/CVE-2025-5301
https://avd.aliyun.com/detail?id=AVD-2025-5301
https://www.nsfocus.net/vulndb/122507
https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/
https://www.onlyoffice.com/blog/zh-hans/2023/03/cve-2022-47412-in-onlyoffice
https://cve.scap.org.cn/vulnerability/VHN-349063
https://www.anquanke.com/post/id/286304
https://github.com/ONLYOFFICE/document-server-integration/issues/252
https://managed-wp.com/zh_cn/blogs/critical-xss-vulnerability-in-onlyoffice-docspace-plugin-cve202411750-2026-02-03/
https://nvd.nist.gov/vuln/detail/CVE-2025-5301