CVE-2023-45138

CVE-2023-45138 affects the Change Request application (XWiki Contrib). From versions 0.11 up to 1.9.1, a user without specific rights could trigger script injection and remote code execution by supplying an appropriate title when creating a new Change Request. This leads to a critical impact, wit...

CVE-2023-49280

The CVE-2023-49280 issue affects the XWiki Change Request extension. By default, Change Request can let a user edit any page and export changes as an XML file, which can leak password hashes when a user profile (or other password-containing document) is edited and the resulting XML is downloaded....