CVE-2024-37901

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of "XWiki.SearchSuggestConfig" and "XWiki.SearchSuggestSourceClass" to their user profile o...

CVE-2024-37901: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or an...

CVE-2024-31465

XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type "XWiki.SearchSuggestSourceClass" to their user profile or any other...

CVE-2024-31465

CVE-2024-31465 affects XWiki Platform. The vulnerability stems from an object type XWiki.SearchSuggestSourceClass that, when added to a user profile or page by any user with edit rights, enables remote code execution on the server, compromising confidentiality, integrity, and availability. Affect...

CVE-2024-31465: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type XWiki.SearchSuggestSourceClass to their user profile or any other page...