PT-2025-33050 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.2 through 18.0.5 GitLab CE/EE versions 18.1 through 18.1.3 GitLab CE/EE versions 18.2 through 18.2.1 Description: An issue exists in GitLab CE/EE that allows authenticated users to create a denial of service condition...

GHSA-GFP2-6QHM-7X43 The WikiManager REST API allows any user to create wikis

Impact Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager...

Transmission of Private Resources into a New Sphere ('Resource Leak')

Overview Affected versions of this package are vulnerable to Transmission of Private Resources into a New Sphere 'Resource Leak' through the REST endpoint. An attacker can access private page information by sending unauthorized requests to the /rest/wikis/wikiName/pages endpoint. Note: This is...

CVE-2025-29926

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard b...

CVE-2025-29926 The WikiManager REST API allows any user to create wikis

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard b...

CVE-2025-29926 The WikiManager REST API allows any user to create wikis

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard b...

XWiki Platform 授权问题漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. An authorization issue vulnerability exists in XWiki Platform versions prior to 15.10.15, prior to 16.4.6, and prior to 16.10.0, which stems from the WikiManager REST API that could be...

Tiki Wiki CMS Groupware <= 29.0 Multiple XSS Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Tiki Wiki CMS Groupware < 28.0 Multiple Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

wapiti

It is an offensive tool for web application security testing. The primary vulnerability class targeted is SQL injection and XSS. The tool is designed to check web applications for vulnerabilities, and it is likely used by security researchers and penetration testers. The tool is written in Python...

MAL-2025-3019 Malicious code in wiki-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9d4143f13c89e66e8f5b2c0905a57d6d25f6d02d46b62aef3e58d4b1f2dda697 Setup.py attempts to exfiltrate information about the system and span a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in wiki-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9d4143f13c89e66e8f5b2c0905a57d6d25f6d02d46b62aef3e58d4b1f2dda697 Setup.py attempts to exfiltrate information about the system and span a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

CVE-2024-13462

The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13462

CVE-2024-13462 (WP Wiki Tooltip, WordPress) : Stored XSS via the wiki shortcode in all versions up to 2.0.2; requires authenticated access at contributor level or higher to inject scripts, which execute when users load the affected pages. Connected data indicates a potential fix in 2.0.3, but ini...

CVE-2024-13462 WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13462 WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-7353 · WordPress · Wp Wiki Tooltip

Name of the Vulnerable Software and Affected Versions: WP Wiki Tooltip plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode due to insufficient input sanitization and output escaping on user...

WordPress plugin WP Wiki Tooltip 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

WordPress WP Wiki Tooltip plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin WP Wiki Tooltip versions = 2.0.2...

CVE-2025-24019

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager FPM on the host without any limitation on the filesystem's scope...