Lucene search

K

4 matches found

CVE
CVE
added 2020/05/05 9:15 p.m.58 views

CVE-2020-11051

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be ...

6.9CVSS5.1AI score0.00323EPSS
CVE
CVE
added 2020/06/16 10:15 p.m.43 views

CVE-2020-4052

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js ...

6.3CVSS6.1AI score0.0024EPSS
CVE
CVE
added 2020/10/05 3:15 p.m.39 views

CVE-2020-15236

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is on...

8.6CVSS7.6AI score0.0047EPSS
CVE
CVE
added 2020/10/26 7:15 p.m.23 views

CVE-2020-15274

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433d...

5.8CVSS5.3AI score0.0059EPSS