EUVD-2026-78592

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966

In XWiki Platform (a generic wiki platform), the Live Data edit REST API fails to perform normal document-saving authorization checks when a user modifies page rights. Any user with edit permission can escalate to script right, enabling execution of potentially dangerous Velocity scripts or deliv...

CVE-2026-53966: Missing Authorization

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

EUVD-2025-13301

Malicious code in bioql PyPI...

EUVD-2025-6756

Malicious code in bioql PyPI...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

CVE-2025-47201 affects Intrexx Portal Server prior to 12.0.4. The issue stems from multiple Velocity-Scripts that may execute unrequested JavaScript in HTML, enabling a cross-site scripting (XSS) condition. Exploitation details are not provided in the documents. Remediation: update to version 12....

Intrexx Portal Server 安全漏洞

Intrexx Portal Server is a cross-platform development environment from Intrexx Corporation. A security vulnerability exists in Intrexx Portal Server versions prior to 12.0.4 that stems from multiple Velocity-Scripts that may execute unsolicited JavaScript code, potentially leading to a cross-site...

CVE-2025-47201: Improper Neutralization of Input During Web Page Generation

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-47201

In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS...

CVE-2025-30092

Intrexx Portal Server 12.x = 12.0.2 and 11.x = 11.9.2 allows XSS in multiple Velocity scripts...

CVE-2025-30092

Intrexx Portal Server 12.x = 12.0.2 and 11.x = 11.9.2 allows XSS in multiple Velocity scripts...

Intrexx Portal Server 安全漏洞

Intrexx Portal Server is a cross-platform development environment from Intrexx Corporation. A security vulnerability exists in Intrexx Portal Server versions 12.0.2 and earlier and 11.9.2 and earlier that stems from a cross-site scripting issue with multiple Velocity scripts...

CVE-2025-30092

The Intrexx Portal Server (a cross-platform development environment) is vulnerable to Cross-Site Scripting (XSS) in multiple Velocity scripts . This flaw affects versions 12.x <= 12.0.2 and 11.x

CVE-2025-30092

Intrexx Portal Server 12.x = 12.0.2 and 11.x = 11.9.2 allows XSS in multiple Velocity scripts...

CVE-2025-30092: Improper Neutralization of Input During Web Page Generation

Intrexx Portal Server 12.x = 12.0.2 and 11.x = 11.9.2 allows XSS in multiple Velocity scripts...

CVE-2023-50732 Velocity execution without script right through tree macro

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1...