OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. This vulnerability can cause denial of service and degrade availability in OpenDocMan installations. Defenders should assess exposure and prioritize remediation, particularly in environments with high user upload activity. The vulnerabilit [truncated]
CVE-2019-25684 is an SQL injection vulnerability in OpenDocMan 1.3.4. The vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter in search.php. Attackers can send GET requests with malicious SQL payloads to extract sensitive database information. This vulnerability has significant implications for the security of OpenDocMan 1.3.4 d [truncated]
