XW
Product
xwiki-commons
7
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 6High 0Medium 1Low 0
Watch
Add xwiki-commons to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-26055 | 9.9 | Mar 2 | XWiki Commons may allow privilege escalation to programming rights via user's first name Affected: >= 3.1-milestone-1, < 13.10.9; >= 14.0-rc-1, < 14.4.4; >= 14.5, < 14.7-rc-1 |
| CVE-2024-31996 | 9.8 | Apr 10 | XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution Affected: >= 3.0.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1 |
| CVE-2023-31126 | 9.6 | May 9 | Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml Affected: >= 14.6-rc-1, < 14.10.4 |
| CVE-2026-23734 | 9.3 | May 20 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash Affected: >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 |
| CVE-2023-29528 | 9.0 | Apr 20 | Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml Affected: >= 4.2-milestone-1, < 14.10 |
| CVE-2023-29201 | 9.0 | Apr 15 | org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability Affected: >= 4.2-milestone-1, < 14.6-rc-1 |
Showing 6