https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 06:57:43 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-01264 bdu:2024-01264 https://cve.radiocsirt.org/vuln/bdu:2024-01264 https://cve.radiocsirt.org/vuln/euvd-2026-214064 EUVD-2026-214064 https://cve.radiocsirt.org/vuln/euvd-2026-214064 https://cve.radiocsirt.org/vuln/fkie_cve-2023-29522 <p>XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. This issue has been patched in XWiki 14.4.8, 14.10.3 and 15.0RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. This issue has been patched in XWiki 14.4.8, 14.10.3 and 15.0RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-29522 https://cve.radiocsirt.org/vuln/ghsa-mjw9-3f9f-jq2w <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-xclass-ui</p> <p>### Impact</p> <p>Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload.</p> <p>For instance: `Open &lt;xwiki-host&gt;/xwiki/bin/view/%22%2F%7D%7D%7B%7B%2Fhtml%7D%7D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=XWiki.ClassSheet&amp;xpage=view`, where `&lt;xwiki-host&gt;` is the URL of your XWiki installation.</p> <p>### Patches This has been patched in XWiki 14.4.8, 14.10.3 and 15.0RC1.</p> <p>### Workarounds The fix is only impacting Velocity templates and page contents, so applying this [patch](https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee) is enough to fix the issue.</p> <p>### References - https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee - https://jira.xwiki.org/browse/XWIKI-20456</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) - Email us at [Security Mailing List](mailto:security@xwiki.org)</p> <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-xclass-ui</p> <p>### Impact</p> <p>Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload.</p> <p>For instance: `Open &lt;xwiki-host&gt;/xwiki/bin/view/%22%2F%7D%7D%7B%7B%2Fhtml%7D%7D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=XWiki.ClassSheet&amp;xpage=view`, where `&lt;xwiki-host&gt;` is the URL of your XWiki installation.</p> <p>### Patches This has been patched in XWiki 14.4.8, 14.10.3 and 15.0RC1.</p> <p>### Workarounds The fix is only impacting Velocity templates and page contents, so applying this [patch](https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee) is enough to fix the issue.</p> <p>### References - https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee - https://jira.xwiki.org/browse/XWIKI-20456</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) - Email us at [Security Mailing List](mailto:security@xwiki.org)</p> https://cve.radiocsirt.org/vuln/ghsa-mjw9-3f9f-jq2w https://cve.radiocsirt.org/vuln/gsd-2023-29522 gsd-2023-29522 https://cve.radiocsirt.org/vuln/gsd-2023-29522