3484 matches found
xwiki-pro-macros 安全漏洞
xwiki-pro-macros is an open source tool from XWiki SAS. It can enhance the functionality of XWiki. A security vulnerability exists in xwiki-pro-macros versions prior to 1.26.5, which stems from a missing escape for the classes parameter and could lead to remote code execution...
PT-2025-36930
Name of the Vulnerable Software and Affected Versions: XWiki Remote Macros versions 1.0 through 1.26.5 Description: XWiki Remote Macros provides XWiki rendering macros used for migrating content from Confluence. A missing escaping mechanism in the confluence paste code macro allows for remote cod...
PT-2025-36918
Name of the Vulnerable Software and Affected Versions: XWiki Remote Macros versions 1.0 through 1.26.5 Description: XWiki Remote Macros provides XWiki rendering macros used for content migration from Confluence. A lack of escaping for the classes parameter within the panel macro allows for remote...
xwiki-pro-macros 安全漏洞
xwiki-pro-macros is an open source tool from XWiki SAS. It can enhance the functionality of XWiki. A security vulnerability exists in xwiki-pro-macros versions prior to 1.26.5, which stems from a lack of escaping of the width parameter and could lead to remote code execution...
xwiki-pro-macros 安全漏洞
xwiki-pro-macros is an open source tool from XWiki SAS. It can enhance the functionality of XWiki. A security vulnerability exists in xwiki-pro-macros versions prior to 1.26.5, which stems from a missing escape for the ac:type parameter and could lead to remote code execution...
PT-2025-36929
Name of the Vulnerable Software and Affected Versions: XWiki Remote Macros versions 1.0 through 1.26.5 Description: XWiki Remote Macros provides XWiki rendering macros used for migrating content from Confluence. A missing escaping mechanism in the ac:type parameter within the...
CVE-2025-58365
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user...
CVE-2025-58365 XWiki Blog Application: Privilege Escalation (PR) from account through blog content
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user...
CVE-2025-58365
The CVE-2025-58365 issue affects the XWiki Blog Application prior to version 9.14. An attacker with edit rights on any page could inject a Blog.BlogPostClass object and place a script macro in the Content field, enabling remote code execution. The vulnerability is mitigated in 9.14 by executing b...
CVE-2025-58365 XWiki Blog Application: Privilege Escalation (PR) from account through blog content
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user...
CVE-2025-58365 XWiki Blog Application: Privilege Escalation (PR) from account through blog content
The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user...
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Impact The blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. To exploit, it is sufficient to add an object of type Blog.BlogPostClass to any page and to add some...
GHSA-GWJ6-XPFG-PXWR XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Impact The blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. To exploit, it is sufficient to add an object of type Blog.BlogPostClass to any page and to add some...
XWiki Contrib Mocca Calendar Application 安全漏洞
XWiki Contrib Mocca Calendar Application is an XWiki plugin from XWiki Contrib open source. A security vulnerability exists in XWiki Contrib Mocca Calendar Application versions prior to 9.14, which stems from a remote code execution in the blog application...
PT-2025-36511
Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 9.14 Description: The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application allowed remote code execution for any logged-in user with edi...
Exploit for Code Injection in Xwiki
exploit-scripts...
CVE-2025-55747
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7...
CVE-2025-55748
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...
Metasploit Weekly Wrap-Up 09/05/2025
Persistence Improvements and Exploits This week, the Metasploit team and the community has made improvements to some persistence modules such as Bash, which improves how they function behind the scenes. They have also been tagged with MITRE ATT&CK techniques. A new exploit has also been added thi...