PT-2022-16966 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 2.3 through 12.6.6 XWiki versions 12.7.0 through 12.10.2 XWiki versions 13.0.0 through 13.0.0 before 13.0RC1 Description: The velocity scripts are not properly sandboxed against using the Java File API to perform read or write...

CVE-2021-32621

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been...

Code injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been...