GO-2026-4456 Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering in github.com/mattermost/mattermost-plugin-confluence...

The vulnerabilities of XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates, a platform for creating collaborative web applications. These vulnerabilities allow attackers to perform cross-site scripting attacks.

The vulnerabilities of XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates, a platform for creating collaborative web applications, are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities can allow attackers to perform...

CVE-2025-66472

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

CVE-2025-66472

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

CVE-2025-66472 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

CVE-2025-66472

XWiki DeleteApplication reflects XSS via a deletion confirmation message. Affected: XWiki Platform Flamingo Skin Resources and Web Templates from 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1. The attack executes attacker-supplied JavaScript when the victim clicks the No button. ...

CVE-2025-66472 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

CVE-2025-66472: Improper Neutralization of Input During Web Page Generation

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

EUVD-2022-6706

Malicious code in bioql PyPI...

EUVD-2022-42502

Malicious code in bioql PyPI...

CVE-2025-8118

PAD CMS implements weak client-side brute-force protection by utilizing two cookies: logincount and logintimeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue...

CVE-2025-8121 Blind SQL Injection in PAD CMS

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability...

PT-2025-39964

Name of the Vulnerable Software and Affected Versions PAD CMS affected versions not specified Description The software’s photo upload functionality allows a remote attacker to upload files of any type and extension without restriction due to a client-controlled permission check parameter. This ca...

PT-2025-50546

Name of the Vulnerable Software and Affected Versions XWiki Platform Flamingo Skin Resources versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 XWiki Platform Web Templates versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 Description The XWiki Platform ...

CVE-2020-11976

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5...

The vulnerabilities of the components org.xwiki.platform:xwiki-platform-web and org.xwiki.platform:xwiki-platform-web-templates of the XWiki platform for creating collaborative web applications. XWiki allows attackers to execute arbitrary code.

The vulnerabilities of the components org.xwiki.platform:xwiki-platform-web and org.xwiki.platform:xwiki-platform-web-templates of the XWiki Platform allow attackers to execute arbitrary code. The XWiki Platform is vulnerable due to a lack of mechanisms for escaping output data. Exploiting these...

GHSA-QCJ9-GCPG-4W2W XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

Impact When document names are validated according to a name strategy disabled by default, XWiki is vulnerable to a reflected XSS attack in the page creation form. To reproduce, make sure that "Validate names before saving" is enabled in the administration under "Editing" - "Name strategies" and...

CVE-2023-45135: Improper Encoding or Escaping of Output

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In org.xwiki.platform:xwiki-platform-web versions 7.2-milestone-2 until 14.10.12 and org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.12 and 15.5-rc-1, it is possible to...

CVE-2023-45137: Improper Neutralization of Input During Web Page Generation

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. org.xwiki.platform:xwiki-platform-web starting in version 3.1-milestone-2 and prior to version 13.4-rc-1, as well as org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.12...

Multiple Self-XSS Vulnerabilites

Description Multiple Self-XSS Vulnerabilities are triggered at multiple endpoints. http://localhost:8083/edit/server/ There is a bug in web/templates/pages/editserver.php file. Attacker can control $vtimezone. php ', theme: '', language: '', hasSmtpRelay: , remoteBackupEnabled: , backupType: '',...