Sync
Products
8- 2 CVEs
- 2 CVEs
- 2 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
Recent CVEs
4| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-20191 | Hig | 0.49 | 7.5 | 0.01 | Mar 16, 2020 | Oxygen XML Editor 21.1.1 allows XXE to read any file. | ||
| CVE-2021-46827 | Med | 0.40 | 6.1 | 0.00 | Jul 13, 2022 | An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a… | ||
| CVE-2023-26559 | Med | 0.35 | 5.3 | 0.01 | Apr 14, 2023 | A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714… | ||
| CVE-2025-48464 | Med | 0.31 | 4.7 | 0.00 | Oct 8, 2025 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information. |
- risk 0.49cvss 7.5epss 0.01
Oxygen XML Editor 21.1.1 allows XXE to read any file.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a…
- risk 0.35cvss 5.3epss 0.01
A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714…
- risk 0.31cvss 4.7epss 0.00
Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.