cve-2025-24893

CVE-2025-24893 Exploit RCE per XWiki Un semplice script Python3 per sfruttare CVE-2025-24893 , una vulnerabilità di esecuzione remota di codice nella piattaforma XWiki, utilizzando una macro asincrona basata su Groovy e un payload di reverse shell configurabile. ⚠️ ATTENZIONE: Questo strumento è...

CVE-2025-24893

XWiki CVE-2025-24893 Prova di concetto Autori : Net.Doge & Infinit3i Questo script Python sfrutta CVE-2025-24893 , una vulnerabilità di esecuzione remota di codice RCE in XWiki causata da un sandboxing improprio nelle macro Groovy renderizzate in modo asincrono. Consente l'esecuzione arbitraria d...

xwiki-cve-2025-24893

XWiki SolrSearch RCE non autenticata CVE-2025-24893 Contributori White Hat School, 4ª generazione, classe 25 임두연@endusdksla Riepilogo XWiki interpreta la sintassi wiki e le macro lato server e le renderizza. Il problema è che la pagina Main.SolrSearch è aperta agli ospiti, eppure valuta il...

CVE-2025-24893-Reverse-Shell

CVE-2025-24893 - Exploit d'exécution de code à distance XWiki PoC pour CVE-2025-24893 – Exécution de code à distance via la macro XWiki Inspiré par le PoC original d'Artemir Description Ceci est un exploit de validation de concept PoC pour CVE-2025-24893 , une vulnérabilité d'exécution de code à...

GHSA-32MF-57H2-64X9 XWiki Rendering is vulnerable to RCE attacks when processing nested macros

Impact The default macro content parser didn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWi...

XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter

Impact When login via the OAuth method, the identityOAuth parameters, sent in a GET request is vulnerable to XSS and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

PT-2023-25177 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.5 XWiki Platform versions prior to 15.1-rc-1 Description: The issue allows execution of any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This can be achieved by...

GHSA-36FM-J33W-C25F Privilege escalation (PR)/RCE from account through class sheet

Impact It's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. Steps to Reproduce: 1. Edit your user profile with the object editor and add an object of type DocumentSheetBinding with value Default Class Sheet 1. Edit your user profile with the...

GHSA-H6F5-8JJ5-CXHR xwiki-platform vulnerable to Remote Code Execution in Annotations

Impact The annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. To reproduce: add an annotation with the content groovyprint "hello"/groovy and click the yellow scare to g...