CVE-2022-36099

CVE-2022-36099 affects XWiki Platform Wiki UI Main Wiki. Affected: XWiki Platform versions 5.3-milestone-2 up to but not including 13.10.6 and 14.4. Root cause: via the request URL parameter, an attacker can inject arbitrary wiki syntax using the XWikiServerClassSheet when the attacker has view a...

EUVD-2022-6981

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the...

CVE-2022-36093

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2...

Authentication flaw

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2...

CVE-2022-36093 XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2...

CVE-2022-36093 XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2...

CVE-2022-36092

CVE-2022-36092 affects XWiki Platform Old Core. Prior to versions 14.2 and 13.10.4, the login action could bypass rights checks and load arbitrary templates, allowing access to titles, content, and comments of documents (and properties of objects) without knowing class/property names; private wik...

PT-2022-23189 · Xwiki · Xwiki Platform Wiki Ui Main Wiki

Name of the Vulnerable Software and Affected Versions: XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 13.10.5 XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 14.3 Description: It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity...

PT-2022-23182 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform Old Core versions prior to 14.2 and 13.10.4 Description: The issue allows all rights checks that would normally prevent a user from viewing a document on a wiki to be bypassed using the login action and directly specified...

Remote file inclusion

Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue...

CVE-2022-36080

Affected software : Wikmd (file-based wiki using Markdown). Vulnerability : Cross-site scripting in versions prior to 1.7.1, enabling an attacker to capture a user’s session cookies or run malicious JavaScript when a victim edits a Markdown file. Root cause/vector : XSS that occurs during the edi...

CVE-2022-36081

Wikmd (a Markdown-based wiki) is affected by CVE-2022-36081 due to a path traversal flaw when accessing /list/path:folderpath , exposing server file lists including sensitive data. The issue affects versions prior to 1.7.1; version 1.7.1 includes the fix. Remediation: upgrade Wikmd to 1.7.1 or la...

CVE-2021-39393

mm-wiki v0.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the markdown editor...

CVE-2021-39394

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

CVE-2021-39393

mm-wiki v0.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the markdown editor...

CVE-2021-39394

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

CVE-2021-39394

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

Cross site request forgery (csrf)

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

Cross site scripting

mm-wiki v0.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the markdown editor...

CVE-2021-39394

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...