CVE-2026-53966

In XWiki Platform (a generic wiki platform), the Live Data edit REST API fails to perform normal document-saving authorization checks when a user modifies page rights. Any user with edit permission can escalate to script right, enabling execution of potentially dangerous Velocity scripts or deliv...

EUVD-2026-78592

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966: Missing Authorization

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

PT-2026-80218

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

EUVD-2025-6756

Malicious code in bioql PyPI...

EUVD-2025-13301

Malicious code in bioql PyPI...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201: Improper Neutralization of Input During Web Page Generation

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

Intrexx Portal Server 安全漏洞

Intrexx Portal Server is a cross-platform development environment from Intrexx Corporation. A security vulnerability exists in Intrexx Portal Server versions prior to 12.0.4 that stems from multiple Velocity-Scripts that may execute unsolicited JavaScript code, potentially leading to a cross-site...

CVE-2025-47201

CVE-2025-47201 affects Intrexx Portal Server prior to 12.0.4. The issue stems from multiple Velocity-Scripts that may execute unrequested JavaScript in HTML, enabling a cross-site scripting (XSS) condition. Exploitation details are not provided in the documents. Remediation: update to version 12....

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-30092

Intrexx Portal Server 12.x = 12.0.2 and 11.x = 11.9.2 allows XSS in multiple Velocity scripts...

CVE-2025-30092

Intrexx Portal Server 12.x = 12.0.2 and 11.x = 11.9.2 allows XSS in multiple Velocity scripts...

CVE-2025-30092

Intrexx Portal Server 12.x = 12.0.2 and 11.x = 11.9.2 allows XSS in multiple Velocity scripts...

PT-2025-11988

Name of the Vulnerable Software and Affected Versions Intrexx Portal Server versions 11.x through 11.9.2 Intrexx Portal Server versions 12.x through 12.0.2 Description The issue allows for XSS in multiple Velocity scripts. Recommendations For Intrexx Portal Server versions 11.x through 11.9.2,...

CVE-2025-30092

The Intrexx Portal Server is vulnerable to a Cross-Site Scripting (XSS) flaw in multiple Velocity scripts . This vulnerability affects versions 12.x <= 12.0.2 and 11.x

Intrexx Portal Server 安全漏洞

Intrexx Portal Server is a cross-platform development environment from Intrexx Corporation. A security vulnerability exists in Intrexx Portal Server versions 12.0.2 and earlier and 11.9.2 and earlier that stems from a cross-site scripting issue with multiple Velocity scripts...