CVE-2024-37898

XWiki Platform (CVE-2024-37898) has a documented issue where a user with view but not delete rights can delete a page and replace it with new content, moving the old version to the recycle bin. Although the old content is not viewable due to rights transfer, the action results in the page being o...

CVE-2024-37898 XWiki Platform vulnerable to document deletion and overwrite from edit

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in XWiki, that user can delete the page and replace it by a page with new content without having delete right. The previous version of the pag...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that originates from allowing any user with editing privileges to execute arbitrary remote code by adding relevant instances to their user...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from improper management of user rights. The following versions are affected: versions 13.10.4 through 14.0-rc-1, 14.2 through...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from a conflict that can compromise the confidentiality, integrity, and availability of an entire XWiki installation by executing...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from improper handling of filenames when uploading attachments, allowing users to upload attachments with malicious filenames,...

PT-2024-5617 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.6 Description: The issue is related to a lack of authorization in the XWiki Platform, allowing a remote attacker to...

PT-2024-29654 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 15.10.8 XWiki Platform versions prior to 16.3.0RC1 Description: The issue allows an attacker to execute JavaScript snippets on the side of another user, compromising the confidentiality, integrity, and...

PT-2024-27818 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.2 Description: The issue allows any user with edit rights on any page to perform arbitrary remote code execution by addin...

PT-2024-5620 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.6 XWiki Platform versions prior to 16.0.0 Description: The issue is related to the execution of malicious JavaScript code...

The vulnerability of the XWiki platform, which is related to the failure to implement measures to neutralize instructions in dynamically executed code, allows a perpetrator to execute arbitrary code.

The vulnerability of the XWiki Platform lies in the lack of measures taken to neutralize instructions within the dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

VulnCheck KEV: CVE-2024-31982

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a close...

CVE-2024-38369 XWiki programming rights may be inherited by inclusion

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using include reference="targetdocument"/ is executed with the right of the includer and not with the right of its author. This means that any user able to...

CVE-2024-38369

CVE-2024-38369 affects XWiki Platform. The vulnerability arises from the include macro: content from a referenced document is executed with the includer’s rights, not the author’s. This allows a user who can modify the target document to impersonate the content author, effectively enabling privil...

XWiki Platform Security Vulnerability

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in versions of XWiki Platform prior to 15.0-rc-1, which stems from the possibility that programming privileges may be inherited via include, which could le...

The vulnerability of the XWiki platform, which is related to incorrect privilege assignment, allows a perpetrator to execute arbitrary code.

The XWiki platform has a vulnerability related to incorrect privilege assignment. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Exploit for Code Injection in Xwiki

CVE-2024-31982 PoC and Bulk Scanner !Bannerscreens/scree...

CVE-2024-37899

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable...

CVE-2024-37899

XWiki Platform CVE-2024-37899: Disabling a user account executes the user’s profile with admin rights, enabling remote code execution via crafted profile content (e.g., Groovy). Affects versions prior to 14.10.21, 15.5.5, 15.10.6, and 16.0.0. Patched releases are 14.10.21, 15.5.5, 15.10.6 and 16....

CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable...