19 matches found
xwiki__xwiki-commons_CVE-2023-31126_14-10-3
XWiki Commons XWiki Commons are technical libraries common to several other top level XWiki projects. These libraries can be used by projects outside of the XWiki ecosystem, are generic and not related to the wiki domain. XWiki Platform, XWiki Commons and XWiki Rendering are part of the XWiki.org...
CVE-2023-31126
org.xwiki.commons:xwiki-commons-xml is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect...
CVE-2025-31126
Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability ...
CVE-2025-31126
creationtimestamp| type| source ---|---|--- 2025-04-03 21:55:43+00:00| seen| https://t.me/cvedetector/22007...
CVE-2025-31126
Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability ...
CVE-2025-31126
Element X iOS (Matrix client) is affected in versions 1.6.13 through 25.03.7 where the entity controlling the element.json well-known file can, under certain conditions, access media encryption keys used for an Element Call, leaking confidentiality. The issue is fixed in version 25.03.8. Affected...
CVE-2025-31126 Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call
Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability ...
CVE-2025-31126 Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call
Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability ...
org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.3) +35 more potentially affected by CVE-2023-31126 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.3)
org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.3 and more Source cves: CVE-2023-31126 Source...
CVE-2023-31126
creationtimestamp| type| source ---|---|--- 2023-05-09 16:38:41+00:00| seen| https://t.me/cibsecurity/63602 2025-08-20 21:00:17+00:00| published-proof-of-concept| Telegram/rkfoWjAqSXezgJulzvtFuydB0ZkPEuMJMmDny8QUUYeolaE 2025-08-22 21:02:34+00:00| seen|...
CVE-2023-31126
The CVE-2023-31126 issue affects org.xwiki.commons:xwiki-commons-xml used by XWiki Platform. The HTML sanitizer introduced in 14.6-rc-1 allows cross-site scripting via invalid data-attribute names, e.g., through XWiki content link constructs. This has been fixed in XWiki 14.10.4 and 15.0 RC1 by r...
CVE-2023-31126 Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
org.xwiki.commons:xwiki-commons-xml is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect...
CVE-2023-31126 Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
org.xwiki.commons:xwiki-commons-xml is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect...
Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution Vulnerability
ADVISORY INFORMATION Exploit Title: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution RCE Date of found: 21 July 2022 Application: Roxy WI = v6.1.0.0 Author: Nuri Çilengir Vendor Homepage: https://roxy-wi.org Software Link: https://github.com/hap-wi/roxy-wi.git Advisory:...
Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
ADVISORY INFORMATION Exploit Title: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution RCE Date of found: 21 July 2022 Application: Roxy WI = v6.1.0.0 Author: Nuri Çilengir Vendor Homepage: https://roxy-wi.org Software Link: https://github.com/hap-wi/roxy-wi.git Advisory:...
CVE-2022-31126
creationtimestamp| type| source ---|---|--- 2022-07-06 22:14:31+00:00| seen| https://t.me/cibsecurity/45692 2023-04-03 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/51227 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-01-26...
CVE-2022-31126
CVE-2022-31126 affects Roxy-wi prior to 6.1.1.0. The Nuclei template confirms remote code execution via the vulnerable path, with commands executed through the application logic (ssh_command) in /app/funct.py, enabling an unauthenticated attacker to run arbitrary code on the target. Exploitation ...