CVE-2024-55877: Improper Neutralization of Directives in Statically Saved Code

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of XWiki.WikiMacroClass to any page. This compromises the confidentiality, integrity...

CVE-2022-36098

Summary (concrete): XWiki Platform Mentions UI allows storing Javascript or groovy scripts in mention/macro anchor/reference fields in versions prior to 13.10.6 and 14.4 (starting with 12.5-rc-1). The stored code is executed when a page with the mention is visited, enabling cross-site scripting. ...