XWiki Contrib Mocca Calendar Application 跨站脚本漏洞

XWiki Contrib Mocca Calendar Application is an open source XWiki plugin for XWiki Contrib. A cross-site scripting vulnerability exists in XWiki Contrib Mocca Calendar Application versions prior to 2.15, which stems from cross-site scripting in the calendar import header...

XWiki Contrib Mocca Calendar Application 跨站脚本漏洞

XWiki Contrib Mocca Calendar Application is an open source XWiki plugin for XWiki Contrib. A cross-site scripting vulnerability exists in XWiki Contrib Mocca Calendar Application versions prior to 2.15, which stems from cross-site scripting in the title of the View Events page...

CVE-2025-52132

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page...

CVE-2025-52133

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import...

CVE-2025-52131

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field...

CVE-2025-52131

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field...

Exploit for Code Injection in Xwiki

Infos This PoC first tests for the SSTI and if it works. It...

Exploit for Code Injection in Xwiki

CVE-2025-24893 - XWiki Platform Remote Code Execution A Pytho...

📄 XWiki 14 SQL Injection

XWiki version 14 suffers from a remote blind SQL injection vulnerability in getdeleteddocuments.vm. Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm Google Dork: N/A Date: 28 July 2025 Exploit Author: Byte Reaper LinkedIn: N/A Vendor Homepage: https://www.xwiki.org Software Link...

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application. This allows attackers to execute arbitrary code.

The vulnerability of the getdeleteddocuments.vm template in the XWiki platform, a collaborative web application, arises from the lack of protection for the SQL query structure during the processing of the sort parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Exploit for CVE-2025-32429

CVE-2025-32429 Vulnerability Checker A Python-based vulnerabi...

CVE-2025-54385

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

XWiki 14 - SQL Injection via getdeleteddocuments.vm

Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm Google Dork: N/A Date: 28 July 2025 Exploit Author: Byte Reaper LinkedIn: N/A Vendor Homepage: https://www.xwiki.org Software Link: https://www.xwiki.org Version: XWiki Platform ≤ 14.x Tested on: XWiki Platform ≤ 14.x CVE:...

CVE-2025-32429

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2025-54385

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

CVE-2025-54385 XWiki Platform's searchDocuments API allows for SQL injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

CVE-2025-54385 XWiki Platform's searchDocuments API allows for SQL injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

CVE-2025-54385

XWiki Platform contains a SQL injection vulnerability in the searchDocuments API. Affected versions are 17.0.0-rc1 through 17.2.2 and 16.10.5 and earlier. The issue arises because queries are passed directly to Hibernate without adequate sanitization, allowing injection of malicious SQL (e.g., vi...

CVE-2025-54385 XWiki Platform's searchDocuments API allows for SQL injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

XWiki Platform 输入验证错误漏洞

XWiki Platform is the XWiki open source suite of Wiki platforms for creating web collaboration applications. An input validation error vulnerability exists in XWiki Platform versions 17.0.0-rc1 through 17.2.2 and 16.10.5 and earlier, which stems from an uncleaned SQL query and could lead to a SQL...