GCVE - cpe:2.3:a:xwiki:pro_macros:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xwiki:pro_macros:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Xwiki (`cdc9c0cd-6ac5-5dc0-9f52-915ebd57f20d`)
Product	Pro Macros (`c5f2b98f-70ff-5af4-a653-22696e519e6a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/xwikisas/xwiki-pro-macros`	purl2cpe	2026-06-01 10:18:15.953050

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-65089`	vulnerable	2026-06-03 15:09:40.183686	XWiki view file macro: User can view content of office file without view rights on the attachment MEDIUM (6.8) XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0. Published: 2025-11-19T17:41:31.805Z Updated: 2025-11-19T18:46:46.790Z Open on db.gcve.eu Reference links https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-8c52-x9w7-vc95	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65036`	vulnerable	2026-06-03 15:09:40.140888	XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro HIGH (8.3) XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1. Published: 2025-12-05T16:10:08.595Z Updated: 2025-12-05T16:27:31.564Z Open on db.gcve.eu Reference links https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-472x-fwh9-r82f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-55728`	vulnerable	2026-06-03 15:04:59.092686	XWiki Remote Macros vulnerable to remote code execution using the panel macro CRITICAL (10) XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue. Published: 2025-09-09T18:40:51.874Z Updated: 2025-09-11T13:15:28.508Z Open on db.gcve.eu Reference links https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 https://jira.xwiki.org/browse/XWIKI-20449	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-55727`	vulnerable	2026-06-03 15:04:59.092244	XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro CRITICAL (10) XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any user who can edit any page or who can access the CKEditor converter. The width parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution when the macro has been installed by a user with programming right, or it at least allows executing Velocity code as the wiki admin. Version 1.26.5 contains a patch for the issue. Published: 2025-09-09T18:31:08.108Z Updated: 2025-09-10T14:14:06.852Z Open on db.gcve.eu Reference links https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-hxqp-983c-m8h9 https://github.com/xwikisas/xwiki-pro-macros/commit/05651adb4b58d03ba862d5290c645feeffd2121b https://github.com/xwikisas/xwiki-pro-macros/blob/aed17fa3db4081846dbb6bdf76ba10cf44401c44/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Column.xml#L438	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42489`	vulnerable	2026-06-03 14:56:42.726922	Pro Macros Remote Code Execution via Viewpdf and similar macros CRITICAL (10) Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1. Published: 2024-08-12T15:49:18.935Z Updated: 2024-08-13T20:43:35.138Z Open on db.gcve.eu Reference links https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-cfq3-q227-7j65 https://github.com/xwikisas/xwiki-pro-macros/commit/199553c84901999481a20614f093af2d57970eba https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Viewpdf.xml#L265-L267	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.