org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

Impact It's possible to forge a request to delete a message. Patches The problem has been patched in version 2.0-rc-1 of Discussion Extension. Workarounds There's no easy workaround except upgrading. References https://jira.xwiki.org/browse/DISCUSSION-22 For more information If you have any...

PT-2025-28222 · Giscus · Giscus

Name of the Vulnerable Software and Affected Versions: giscus affected versions not specified Description: A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which i...