XWiki 14.10 Release Candidate 1
Approved changes feed: RSS · Atom
cpe:2.3:a:xwiki:xwiki:14.10:rc1:*:*:*:*:*:*
part: a version: 14.10 update: rc1
| Vendor | Xwiki (cdc9c0cd-6ac5-5dc0-9f52-915ebd57f20d) |
|---|---|
| Product | Xwiki (2fad5bf8-5703-5dac-bd8d-95a867c2e84d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/xwiki/xwiki |
purl2cpe | 2026-06-01 10:18:15.715460 |
pkg:github/xwiki/xwiki-platform |
purl2cpe | 2026-06-01 10:18:15.715461 |
pkg:gitlab/q-phillips/xwiki-platform |
purl2cpe | 2026-06-01 10:18:15.715462 |
pkg:xwiki/xwiki |
purl2cpe | 2026-06-01 10:18:15.715464 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-29509 |
vulnerable | 2026-06-03 14:51:41.187127 |
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL (10)
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `documentTree` macro parameters in This macro is installed by default in `FlamingoThemesCode.WebHome`. This page is installed by default. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.
Published: 2023-04-16T07:04:17.561Z
Updated: 2025-02-06T17:05:13.549Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29508 |
vulnerable | 2026-06-03 14:51:41.186719 |
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
HIGH (8.9)
XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
Published: 2023-04-16T07:00:43.391Z
Updated: 2025-02-06T16:14:25.016Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29507 |
vulnerable | 2026-06-03 14:51:41.186299 |
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
CRITICAL (9.1)
XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
Published: 2023-04-16T06:52:19.020Z
Updated: 2025-02-06T16:59:43.751Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29506 |
vulnerable | 2026-06-03 14:51:41.185703 |
org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
MEDIUM (5.4)
XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
Published: 2023-04-16T06:49:51.376Z
Updated: 2025-02-06T17:02:00.453Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29214 |
vulnerable | 2026-06-03 14:51:40.208599 |
org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL (10)
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. The problem has been patched on XWiki 14.4.7, and 14.10.
Published: 2023-04-16T06:45:57.295Z
Updated: 2025-02-06T17:02:46.163Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29212 |
vulnerable | 2026-06-03 14:51:40.203090 |
xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL (10)
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10.
Published: 2023-04-16T06:39:52.119Z
Updated: 2025-02-06T17:03:47.993Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29211 |
vulnerable | 2026-06-03 14:51:40.202505 |
org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
CRITICAL (10)
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.
Published: 2023-04-16T06:34:27.926Z
Updated: 2025-02-06T17:05:23.638Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29210 |
vulnerable | 2026-06-03 14:51:40.201929 |
org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
CRITICAL (10)
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.
Published: 2023-04-15T16:20:29.342Z
Updated: 2025-02-06T17:04:48.251Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.