xwikisas

6 results · Clear filters · Feed

• High 8.3
  CVE-2025-65036

  XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

  XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vul…

  xwikisas xwiki-pro-macros
  Dec 5, 2025
• High 7.5
  CVE-2025-27604

  XWiki Confluence Migrator Pro's homepage is public

  XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed …

  xwikisas application-confluence-migrator-pro com.xwiki.confluencepro:application-confluence-migrator-pro-ui Web / CMS Maven
  Mar 7, 2025
• High 7.5
  CVE-2024-52298

  macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

  macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachm…

  xwikisas macro-pdfviewer
  Nov 13, 2024
• High 7.5
  CVE-2024-52299

  The PDF viewer macro allows accessing any attachment without access right checks

  macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the dige…

  xwikisas macro-pdfviewer
  Nov 13, 2024
• High 7.7
  CVE-2024-30263

  The PDF Viewer macro can be used to view PDF attachments with restricted access

  macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights ca…

  xwikisas macro-pdfviewer
  Apr 4, 2024
• High 7.4
  CVE-2023-46743

  The same file cannot be opened with different rights

  application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a…

  xwikisas application-collabora
  Nov 9, 2023