xwiki__xwiki-rendering_CVE-2023-32070_14-5

XWiki Rendering XWiki Rendering — это универсальная система рендеринга, которая преобразует текстовый ввод в заданном синтаксисе вики-синтаксис, HTML и т. д. в другой синтаксис XHTML и т. д.. XWiki Platform, XWiki Commons и XWiki Rendering являются частью платформы разработки XWiki.org. Они...

xwiki__xwiki-commons_CVE-2023-29201_14-5

XWiki Commons XWiki Commons sont des bibliothèques techniques communes à plusieurs autres projets XWiki de haut niveau. Ces bibliothèques peuvent être utilisées par des projets en dehors de l'écosystème XWiki, sont génériques et non liées au domaine wiki. XWiki Platform, XWiki Commons et XWiki...

xwiki__xwiki-commons_CVE-2023-31126_14-10-3

XWiki Commons XWiki Commons sont des bibliothèques techniques communes à plusieurs autres projets de niveau supérieur de XWiki. Ces bibliothèques peuvent être utilisées par des projets extérieurs à l'écosystème XWiki, sont génériques et ne sont pas liées au domaine wiki. XWiki Platform, XWiki...

xwiki__xwiki-rendering_CVE-2023-37908_14-10-3

XWiki Rendering XWiki Rendering est un système de rendu générique qui convertit une entrée textuelle dans une syntaxe donnée syntaxe wiki, HTML, etc. vers une autre syntaxe XHTML, etc.. XWiki Platform, XWiki Commons et XWiki Rendering font partie de la forge logicielle XWiki.org. Ils sont publiés...

CVE-2025-53837

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

EUVD-2025-210935

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837

XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...

GHSA-26VP-8GXG-V4PG org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

Eval Injection

Overview org.xwiki.rendering:xwiki-rendering-xml is a library for the XWiki Rendering Engine Affected versions of this package are vulnerable to Eval Injection via the printRaw method in XHTMLWikiPrinter in xwiki-rendering-xml. An attacker can execute arbitrary script macros, including Groovy or...

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

CVE-2025-53837: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

Remote Code Execution (RCE)

org.xwiki.rendering:xwiki-rendering-xml is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient protection against /html injection, which allows an attacker to inject and execute arbitrary script macros leading to code execution and unauthorized data access...

CVE-2025-66474

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

CVE-2025-66474

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

CVE-2025-66474 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

CVE-2025-66474: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

XWiki Rendering 安全漏洞

XWiki Rendering is a general-purpose rendering system from the XWiki Foundation that converts text input from a given syntax wiki syntax, HTML, etc. to another syntax XHTML, etc.. A security vulnerability exists in XWiki Rendering versions 16.10.9 and earlier, 17.0.0-rc-1 through 17.4.2, and...