GHSA-QCJ3-WPGM-QPXH XWiki programming rights may be inherited by inclusion

Impact The content of a document included using include reference="targetdocument"/ is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the include macro...

XWiki programming rights may be inherited by inclusion

Impact The content of a document included using include reference="targetdocument"/ is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the include macro...

CVE-2024-38369

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using include reference="targetdocument"/ is executed with the right of the includer and not with the right of its author. This means that any user able to...

CVE-2024-38369 XWiki programming rights may be inherited by inclusion

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using include reference="targetdocument"/ is executed with the right of the includer and not with the right of its author. This means that any user able to...

CVE-2024-38369

CVE-2024-38369 affects XWiki Platform. The vulnerability arises from the include macro: content from a referenced document is executed with the includer’s rights, not the author’s. This allows a user who can modify the target document to impersonate the content author, effectively enabling privil...

CVE-2024-38369 XWiki programming rights may be inherited by inclusion

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using include reference="targetdocument"/ is executed with the right of the includer and not with the right of its author. This means that any user able to...

CVE-2024-38369 XWiki programming rights may be inherited by inclusion

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using include reference="targetdocument"/ is executed with the right of the includer and not with the right of its author. This means that any user able to...

XWiki Platform Security Vulnerability

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in versions of XWiki Platform prior to 15.0-rc-1, which stems from the possibility that programming privileges may be inherited via include, which could le...

The vulnerability of the XWiki platform, which is related to incorrect privilege assignment, allows a perpetrator to execute arbitrary code.

The XWiki platform has a vulnerability related to incorrect privilege assignment. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Exploit for Code Injection in Xwiki

CVE-2024-31982 PoC and Bulk Scanner !Bannerscreens/scree...

CVE-2024-37899

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable...

CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable...

CVE-2024-37899

XWiki Platform CVE-2024-37899: Disabling a user account executes the user’s profile with admin rights, enabling remote code execution via crafted profile content (e.g., Groovy). Affects versions prior to 14.10.21, 15.5.5, 15.10.6, and 16.0.0. Patched releases are 14.10.21, 15.5.5, 15.10.6 and 16....

CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable...

CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable...

GHSA-J584-J2VJ-3F93 XWiki Platform allows remote code execution from user account

Impact When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable the user account. To reproduce, as a user without script nor programming rights, edit the about...

XWiki Platform allows remote code execution from user account

Impact When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable the user account. To reproduce, as a user without script nor programming rights, edit the about...

XWiki Platform Code Injection Vulnerability

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions prior to 14.10.21, 15.5.5, 15.10.6, and 16.0.0, which stems from the fact that disabling a user account changes its author,...

PT-2025-7547

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 15.10.11 XWiki versions prior to 16.4.1 XWiki versions prior to 16.5.0RC1 Description XWiki Platform is susceptible to a remote code execution RCE vulnerability. An unauthenticated attacker can execute arbitrary code by...

Remote Code Execution (RCE)

org.xwiki.commons:xwiki-commons-velocity is vulnerable Remote Code Execution RCE. The vulnerability is due to improper HTML escape functionality, where the escaping tool used in XWiki fails to properly escape the character. This allows an attacker to inject malicious XWiki syntax, potentially...