3563 matches found
CVE-2025-52472 XWiki Platform vulnerable to HQL injection via wiki and space search REST API
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the orderField parameter. The specified value is...
CVE-2025-52472
XWiki Platform is vulnerable to Hibernate Query Language (HQL) injection in the wiki/space search REST API. Affected versions are 4.3-milestone-1 up to but not including 16.10.9, 17.4.2, and 17.5.0. The vulnerability arises from the orderField parameter, where the value is inserted twice in the q...
CVE-2025-52472 XWiki Platform vulnerable to HQL injection via wiki and space search REST API
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the orderField parameter. The specified value is...
CVE-2025-52472 XWiki Platform vulnerable to HQL injection via wiki and space search REST API
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the orderField parameter. The specified value is...
CVE-2025-49594 XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-49594 XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-49594 XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-49594
Summary : CVE-2025-49594 affects XWiki OIDC. From version 2.17.1 up to, but not including, 2.18.2, any user with VIEW access to another user’s profile can forge a token for that user. If the instance allows token authentication, this enables authentication as any user whose profile is viewable. I...
XWiki Platform SQL注入漏洞
XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A SQL injection vulnerability exists in XWiki Platform versions 4.3-milestone-1 through 16.10.9, 17.4.2, and prior to 17.5.0, which stems from an HQL injection in the orderField parameter an...
PT-2025-40900
Name of the Vulnerable Software and Affected Versions XWiki versions 2.17.1 through 2.18.1 Description XWiki OpenID Connect OIDC contains tools for manipulating the OpenID Connect protocol. Individuals with VIEW access to a user profile can generate a token for that user in versions prior to...
EUVD-2023-2250
Malicious code in bioql PyPI...
EUVD-2025-0066
Malicious code in bioql PyPI...
EUVD-2025-23656
Malicious code in bioql PyPI...
EUVD-2023-1356
Malicious code in bioql PyPI...
EUVD-2022-1100
Malicious code in bioql PyPI...
EUVD-2025-12749
Malicious code in bioql PyPI...
EUVD-2023-0963
Malicious code in bioql PyPI...
EUVD-2022-7395
Malicious code in bioql PyPI...