CVE-2025-24893

XWiki CVE-2025-24893 Prueba de Concepto Autores : Net.Doge y Infinit3i Este script de Python explota CVE-2025-24893 , una vulnerabilidad de ejecución remota de código RCE en XWiki causada por un sandboxing inadecuado en macros de Groovy renderizadas de forma asíncrona. Permite la ejecución...

cve-2025-24893

CVE-2025-24893 XWiki RCE 漏洞利用 一个简单的 Python3 脚本，用于利用 CVE-2025-24893 （XWiki 平台中的一个远程代码执行漏洞），使用基于 Groovy 的异步宏和可配置的反向 Shell 载荷。 ⚠️ 警告： 该工具仅供教育和授权测试目的 使用。未经授权针对您不拥有或未经明确许可测试的系统使用是非法且不道德的。 目录 功能特性 需求 安装 使用 检测与协议回退 反向 Shell 载荷 许可证 免责声明 功能特性 ✅ 自动检测目标是否支持 HTTPS 或 HTTP ✅ 构建 Groovy ProcessBuilder 片段以避免...

CVE-2025-24893-Reverse-Shell

CVE-2025-24893 - XWiki Remote Code Execution Exploit PoC for CVE-2025-24893 – XWiki Macro Remote Code Execution Inspired by Artemir's original PoC Description This is a Proof-of-Concept PoC exploit for CVE-2025-24893 , a Remote Code Execution RCE vulnerability in vulnerable versions of XWiki. The...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contribuyentes 4.ª promoción, clase 25 de la Escuela Whitehat 임두연@endusdksla Resumen XWiki interpreta y renderiza la sintaxis wiki y las macros en el lado del servidor. El problema es que la página Main.SolrSearch está abierta a los invitados y,...

Exploit for Code Injection in Xwiki

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 ---...

GHSA-32MF-57H2-64X9 XWiki Rendering is vulnerable to RCE attacks when processing nested macros

Impact The default macro content parser didn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWi...

XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter

Impact When login via the OAuth method, the identityOAuth parameters, sent in a GET request is vulnerable to XSS and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

CVE-2023-45144: Improper Neutralization of Input During Web Page Generation

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

PT-2023-25177 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.5 XWiki Platform versions prior to 15.1-rc-1 Description: The issue allows execution of any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This can be achieved by...

GHSA-36FM-J33W-C25F Privilege escalation (PR)/RCE from account through class sheet

Impact It's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. Steps to Reproduce: 1. Edit your user profile with the object editor and add an object of type DocumentSheetBinding with value Default Class Sheet 1. Edit your user profile with the...

GHSA-H6F5-8JJ5-CXHR xwiki-platform vulnerable to Remote Code Execution in Annotations

Impact The annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. To reproduce: add an annotation with the content groovyprint "hello"/groovy and click the yellow scare to g...