Design/Logic Flaw

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26477

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the "newThemeName" request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26477 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26477: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2022-29251

XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the "FlamingoThemesCode.WebHomeSheet" wiki page related to the "newThemeName" form field. Th...

PT-2022-19499

Name of the Vulnerable Software and Affected Versions XWiki Platform Flamingo Theme UI versions prior to 12.10.11 XWiki Platform Flamingo Theme UI versions prior to 13.4.7 XWiki Platform Flamingo Theme UI versions prior to 13.10.3 XWiki Platform Flamingo Theme UI version 14.0-rc-1 and earlier...

CVE-2022-29251: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the FlamingoThemesCode.WebHomeSheet wiki page related to the "newThemeName" form field. The...