Approved changes feed: RSS · Atom
cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*
part: a version: 15.0 update: *
| Vendor | Xwiki (cdc9c0cd-6ac5-5dc0-9f52-915ebd57f20d) |
|---|---|
| Product | Xwiki (2fad5bf8-5703-5dac-bd8d-95a867c2e84d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-35160 |
vulnerable | 2026-06-08 06:06:26.673003 |
XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
CRITICAL (9.7)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Published: 2023-06-23T18:48:18.136Z
Updated: 2024-11-27T20:07:56.811Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35159 |
vulnerable | 2026-06-08 06:06:26.671053 |
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
CRITICAL (9.7)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Published: 2023-06-23T18:34:17.641Z
Updated: 2024-11-27T20:08:52.221Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35157 |
vulnerable | 2026-06-08 06:06:26.665244 |
XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
HIGH (8.5)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.
Published: 2023-06-23T18:22:54.954Z
Updated: 2024-11-27T20:10:32.697Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35156 |
vulnerable | 2026-06-08 06:06:26.664622 |
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
CRITICAL (9.7)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability.
Published: 2023-06-23T18:19:56.802Z
Updated: 2024-11-27T20:12:17.092Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35152 |
vulnerable | 2026-06-08 06:06:26.657868 |
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
CRITICAL (10)
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.
Published: 2023-06-23T16:41:51.268Z
Updated: 2024-11-27T20:45:47.820Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35151 |
vulnerable | 2026-06-08 06:06:26.654332 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34465 |
vulnerable | 2026-06-08 06:06:25.652388 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34464 |
vulnerable | 2026-06-08 06:06:25.650531 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.