3 results · Clear filters · Feed
-
Critical 9.3
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocu…
-
Critical 9.1CVE-2023-32071 EPSS 70%
XWiki Platform vulnerable to RXSS via editor parameter - importinline template
XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page w…
-
Critical 10.0CVE-2023-29525 EPSS 78%
Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdmin…