XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from a REST API that exposes the history of any page in XWiki whose name is known to an attacker, leading to information disclosu...

PT-2025-18291 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 13.5-rc-1 through 15.10.12 XWiki versions 16.0.0-rc-1 through 16.4.3 XWiki versions 16.5.0-rc-1 through 16.7.x Description: The issue is related to an open redirect vulnerability in the HTML conversion request filter. This allo...

PT-2025-25437 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions before 15.10.16 XWiki versions 16.0.0-rc-1 through 16.4.6 XWiki versions 16.5.0-rc-1 through 16.10.1 Description: The issue concerns XWiki, a generic wiki platform. In affected versions, an attacker without script or programmin...

PT-2025-25439 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 15.10.16 XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.2 Description: The issue arises when a user without script rights creates a document containing an XWiki.Notifications.Code.NotificationDisplayerCla...

PT-2025-25434 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 15.10.16 XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.2 Description: The issue affects XWiki, a generic wiki platform. It occurs when a user without script right creates a document with an...

PT-2025-18294 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 15.9-rc-1 through 15.10.12 XWiki versions 16.0.0-rc-1 through 16.4.3 XWiki versions 16.5.0-rc-1 through 16.8.0-rc-1 Description: The issue arises when a user with programming rights edits a document in XWiki that was last edite...

XWiki < 15.10.11 Improper Access Control Vulnerability (GHSA-f963-4cq8-2gw7)

Xwiki is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki 1.1.2 < 14.10.21, 15.0 < 15.5.5, 15.6 < 15.10.6 XSS Vulnerability (GHSA-wcg9-pgqv-xm5v)

Xwiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

GHSA-F963-4CQ8-2GW7 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

Impact A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit...

In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

Impact A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit...

GHSA-WCG9-PGQV-XM5V XWiki Platform allows XSS through XClass name in string properties

Impact Is it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Reproduction steps 1. As a user without script or programming right, create a non-terminal document...

XWiki Platform allows XSS through XClass name in string properties

Impact Is it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Reproduction steps 1. As a user without script or programming right, create a non-terminal document...

CVE-2024-43400

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Thi...

CVE-2024-43401

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned...

CVE-2024-43400 XWiki Platform allows XSS through XClass name in string properties

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Thi...

CVE-2024-43400 XWiki Platform allows XSS through XClass name in string properties

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Thi...

CVE-2024-43400 XWiki Platform allows XSS through XClass name in string properties

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Thi...

CVE-2024-43400

CVE-2024-43400 refers to an XSS vulnerability in the XWiki Platform. A user without Script/Programming rights could be enticed to follow a crafted URL that leads to a page containing arbitrary JavaScript. The issue is documented across multiple sources, and patches exist: XWiki 14.10.21, 15.5.5, ...

CVE-2024-43401 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned...

CVE-2024-43401 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned...