https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T21:49:05.838373+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-40572 CVE-2023-40572 — XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action 2026-10-23T21:49:05.853824+00:00

Affected: xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.