Technology · Packagist

showdoc/showdoc (Packagist) vulnerabilities

Updated 28 September 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 42 vulnerabilities in showdoc/showdoc (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-6982, was published on 25 April 2026.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 0
Exploited in the wild: 0

Latest showdoc/showdoc (Packagist) vulnerabilities

CVE-2026-6982: ShowDoc has an Injection vulnerabilitylowCVSS 3.1EPSS 0.3%25 Apr 2026
CVE-2025-0520: ShowDoc unrestricted file upload vulnerabilitymediumCVSS 4EPSS 2.6%29 Apr 2025
CVE-2018-16342: Showdoc XSS VulnerabilitylowCVSS 3EPSS 0.6%14 May 2022
CVE-2018-19609: Showdoc Forced BrowsinglowCVSS 3EPSS 1.2%14 May 2022
CVE-2018-19621: Showdoc CSRF VulnerabilitylowCVSS 3EPSS 0.4%14 May 2022
CVE-2018-19620: Showdoc Unauthenticated AccesslowCVSS 3EPSS 1.3%13 May 2022
CVE-2022-1034: Unrestricted Upload of File with Dangerous Type in ShowDoclowCVSS 3.1EPSS 1.5%23 Mar 2022
CVE-2022-0945: Stored Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.8%16 Mar 2022
CVE-2022-0950: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.6%16 Mar 2022
CVE-2022-0951: File Upload Restriction Bypass leading to Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.9%16 Mar 2022
CVE-2022-0957: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.8%16 Mar 2022
CVE-2022-0956: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.7%16 Mar 2022
CVE-2022-0942: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.8%16 Mar 2022
CVE-2022-0964: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.8%16 Mar 2022
CVE-2022-0965: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.9%16 Mar 2022
CVE-2022-0967: Stored Cross-site Scripting in showdoclowCVSS 3EPSS 3.3%16 Mar 2022
CVE-2022-0966: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.5%16 Mar 2022
CVE-2022-0941: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.6%15 Mar 2022
CVE-2022-0937: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.5%15 Mar 2022
CVE-2022-0938: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.6%15 Mar 2022
CVE-2022-0940: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.5%15 Mar 2022
CVE-2022-0946: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.8%15 Mar 2022
CVE-2022-0960: Cross-site Scripting in showdoc/showdoclowCVSS 3EPSS 0.9%15 Mar 2022
CVE-2022-0962: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.9%15 Mar 2022
CVE-2022-0880: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.7%13 Mar 2022

Most severe showdoc/showdoc (Packagist) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2025-0520: ShowDoc unrestricted file upload vulnerabilitymediumCVSS 4EPSS 2.6%29 Apr 2025
CVE-2021-36440: Unrestricted File Upload in ShowDoc v2.9.5lowCVSS 3.1EPSS 4.8%9 Sep 2021
CVE-2022-1034: Unrestricted Upload of File with Dangerous Type in ShowDoclowCVSS 3.1EPSS 1.5%23 Mar 2022
CVE-2021-41745: Showdoc File Upload VulnerabilitylowCVSS 3.1EPSS 1.4%25 Oct 2021
CVE-2021-3678: Use of Cryptographically Weak Pseudo-Random Number Generator in showdoclowCVSS 3.1EPSS 1.1%2 Sep 2021
CVE-2022-0409: Unrestricted Upload of File with Dangerous Type in showdoclowCVSS 3.1EPSS 0.9%20 Feb 2022
CVE-2022-0965: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.9%16 Mar 2022
CVE-2022-0962: Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.9%15 Mar 2022
CVE-2021-3990: showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)lowCVSS 3.1EPSS 0.9%3 Dec 2021
CVE-2022-0951: File Upload Restriction Bypass leading to Cross-site Scripting in ShowDoclowCVSS 3.1EPSS 0.9%16 Mar 2022

Vulnerabilities per week

The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
6 Jul 2026		0	0
13 Jul 2026		0	0
20 Jul 2026		0	0
27 Jul 2026		0	0
3 Aug 2026		0	0
10 Aug 2026		0	0
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0
28 Sep 2026		0	0

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/showdoc-showdoc.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "showdoc/showdoc (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/showdoc-showdoc, 28 September 2026.