xwiki-rendering

6 results · Clear filters · Feed

• Critical 9.9
  CVE-2025-53837

  org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

  XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document c…

  xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-xml Maven
  Sep 18, 2026
• Critical 10.0
  CVE-2025-53836

  XWiki Rendering is vulnerable to RCE attacks when processing nested macros

  XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro con…

  xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-transformation-macro Maven
  Jul 14, 2025
• Critical 9.1
  CVE-2025-53835

  XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

  XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` sy…

  xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-syntax-xhtml Maven
  Jul 14, 2025
• Critical 10.0
  CVE-2023-37912

  XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro

  XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and…

  xwiki xwiki-rendering org.xwiki.platform:xwiki-core-rendering-macro-footnotes org.xwiki.rendering:xwiki-rendering-macro-footnotes Maven
  Oct 25, 2023
• Critical 9.1
  CVE-2023-37908 Public exploit

  org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability

  XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-si…

  xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-xml Maven
  Oct 25, 2023
• Critical 9.1
  CVE-2023-32070 Public exploit

  Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

  XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This h…

  xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-syntax-xhtml org.xwiki.platform:xwiki-platform-annotation-core Maven
  May 10, 2023