Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24045 Stored Cross-Site Scripting in Docmost Public Share Page Before Version 0.25.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24045
Post summary
CVE-2026-24045 is a stored XSS vulnerability affecting Docmost Public Share Page before version 0.25.0. No PoC, exploit, or patch information is included in the text.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | docmost | docmost | - | - | - |