xwikisas

9 results · Clear filters · Feed

• Critical 9.9
  CVE-2026-44179

  XWiki Pro Macros: excerpt-include title and content injection executes code

  XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's …

  xwikisas xwiki-pro-macros com.xwiki.pro:xwiki-pro-macros Maven
  Oct 28, 2026
• Critical 10.0
  CVE-2025-55730

  XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro

  XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the title in the confluence paste code macro allows remote code execution for …

  xwikisas xwiki-pro-macros
  Sep 9, 2025
• Critical 10.0
  CVE-2025-55729

  XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro

  XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the ac:type in the ConfluenceLayoutSection macro allows remote code execution …

  xwikisas xwiki-pro-macros
  Sep 9, 2025
• Critical 10.0
  CVE-2025-55728

  XWiki Remote Macros vulnerable to remote code execution using the panel macro

  XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any …

  xwikisas xwiki-pro-macros
  Sep 9, 2025
• Critical 10.0
  CVE-2025-55727

  XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro

  XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any u…

  xwikisas xwiki-pro-macros
  Sep 9, 2025
• Critical 9.1
  CVE-2025-27603

  XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations

  XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. …

  xwikisas application-confluence-migrator-pro com.xwiki.confluencepro:application-confluence-migrator-pro-ui Web / CMS Maven
  Mar 7, 2025
• Critical 9.1
  CVE-2024-52300

  macro-pdfviewer has a XSS through the width parameter

  macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whol…

  xwikisas macro-pdfviewer
  Nov 13, 2024
• Critical 10.0
  CVE-2024-42489

  Pro Macros Remote Code Execution via Viewpdf and similar macros

  Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnera…

  xwikisas xwiki-pro-macros
  Aug 12, 2024
• Critical 10.0
  CVE-2023-45144

  Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

  com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site…

  xwikisas identity-oauth com.xwiki.identity-oauth:identity-oauth-ui Maven
  Oct 16, 2023