CVE-2025-68935
Medium · 6.4CVSS
6.4
EPSS
0.2%
Published
Dec 25, 2025
CISA due date
—
The record
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|