CVE-2025-49594

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...

GHSA-F2HF-PFRJ-VRM7 XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Impact Anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user since users are very commonly viewable, at least to other registered users. Patches Version 2.18.2...

CVE-2025-49594 XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...

PT-2025-40900

Name of the Vulnerable Software and Affected Versions XWiki versions 2.17.1 through 2.18.1 Description XWiki OpenID Connect OIDC contains tools for manipulating the OpenID Connect protocol. Individuals with VIEW access to a user profile can generate a token for that user in versions prior to...

CVE-2023-45656

Cross-Site Request Forgery CSRF vulnerability in Kevin Weber Lazy Load for Videos plugin = 2.18.2 versions...

PT-2023-29631 · WordPress · Kevin Weber Lazy Load For Videos

Name of the Vulnerable Software and Affected Versions: Kevin Weber Lazy Load for Videos plugin versions = 2.18.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions o...

WordPress Real Cookie Banner plugin <= 2.18.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Real Cookie Banner plugin versions = 2.18.1. Solution Update the WordPress Real Cookie Banner plugin to the latest available version at least 2.18.2...