CVE-2023-48241: Improper Authorization

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wiki...

XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu

Impact XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name ...

CVE-2023-46731 Remote code execution through the section parameter in Administration as guest in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL parameter that is used in the code for displaying administration sections. This allows any user with read access to the document XWiki.AdminSheet ...

CVE-2023-46731

XWiki Platform is affected by a remote code execution (RCE) vulnerability stemming from improper escaping of the section URL parameter in the administration UI (XWiki.AdminSheet). With read access, including unauthenticated users, an attacker can inject and execute Groovy code, impacting confiden...