CVE-2025-52131

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field...

CVE-2025-52132

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page...

CVE-2025-52133

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import...

CVE-2025-52131

The Mocca Calendar application for XWiki is affected by a cross-site scripting (XSS) vulnerability in the background or text color fields, exploitable in versions prior to 2.15. Root cause: input in UI fields not properly sanitized, allowing injected scripts to execute in a victim’s browser. Affe...

CVE-2025-52131

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field...

XWiki Contrib Mocca Calendar Application 跨站脚本漏洞

XWiki Contrib Mocca Calendar Application is an open source XWiki plugin for XWiki Contrib. A cross-site scripting vulnerability exists in XWiki Contrib Mocca Calendar Application versions prior to 2.15, which stems from cross-site scripting in the title of the View Events page...

XWiki Contrib Mocca Calendar Application 跨站脚本漏洞

XWiki Contrib Mocca Calendar Application is an open source XWiki plugin for XWiki Contrib. A cross-site scripting vulnerability exists in XWiki Contrib Mocca Calendar Application versions prior to 2.15, which stems from cross-site scripting in the calendar import header...

CVE-2025-52132

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page...

CVE-2025-52133

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import...

CVE-2025-52131

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field...

CVE-2025-52131

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field...

Exploit for Code Injection in Xwiki

Infos This PoC first tests for the SSTI and if it works. It...

Exploit for Code Injection in Xwiki

CVE-2025-24893 - XWiki Platform Remote Code Execution A Pytho...

📄 XWiki 14 SQL Injection

XWiki version 14 suffers from a remote blind SQL injection vulnerability in getdeleteddocuments.vm. Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm Google Dork: N/A Date: 28 July 2025 Exploit Author: Byte Reaper LinkedIn: N/A Vendor Homepage: https://www.xwiki.org Software Link...

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application. This allows attackers to execute arbitrary code.

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application, arises from the lack of protection for the SQL query structure during the processing of the sort parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Exploit for CVE-2025-32429

CVE-2025-32429 Vulnerability Checker A Python-based vulnerabi...

CVE-2025-54385

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

XWiki 14 - SQL Injection via getdeleteddocuments.vm

Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm Google Dork: N/A Date: 28 July 2025 Exploit Author: Byte Reaper LinkedIn: N/A Vendor Homepage: https://www.xwiki.org Software Link: https://www.xwiki.org Version: XWiki Platform ≤ 14.x Tested on: XWiki Platform ≤ 14.x CVE:...

CVE-2025-32429

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2025-54385

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...