Documize vulnerabilities
We track 2 vulnerabilities in Documize products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Documize vulnerabilities
- 7.5 High severity
community: Incorrect Authorization
Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), w
- 9.8 Critical severity
Documize: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.