https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:28:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-10719 bdu:2025-10719 https://cve.radiocsirt.org/vuln/bdu:2025-10719 https://cve.radiocsirt.org/vuln/euvd-2026-221299 EUVD-2026-221299 https://cve.radiocsirt.org/vuln/euvd-2026-221299 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27603 <p>XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn&#39;t have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0.</p> <p>XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn&#39;t have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-27603 https://cve.radiocsirt.org/vuln/ghsa-6qvp-39mm-95v8 <p><strong>Affected:</strong> Maven: com.xwiki.confluencepro:application-confluence-migrator-pro-ui</p> <p>### Impact A user that doesn&#39;t have programming rights can execute arbitrary code when creating a page using the Migration Page template. A possible attack vector is the following: * Create a page and add the following content: ``` confluencepro.job.question.advanced.input={{/html}} {{async async=&#34;true&#34; cached=&#34;false&#34; context=&#34;doc.reference&#34;}}{{groovy}}println(&#34;hello from groovy!&#34;){{/groovy}}{{/async}} ``` * Use the object editor to add an object of type `XWiki.TranslationDocumentClass` with scope `USER`. * Access an unexisting page using the `MigrationTemplate` ``` http://localhost:8080/xwiki/bin/edit/Page123?template=ConfluenceMigratorPro.Code.MigrationTemplate ``` It is expected that `{{/html}} {{async async=&#34;true&#34; cached=&#34;false&#34; context=&#34;doc.reference&#34;}}{{groovy}}println(&#34;hello from groovy!&#34;){{/groovy}}{{/async}}` will be present on the page, however, `hello from groovy` will be printed. ### Patches The issue will be fixed as part of v1.2. The fix was added with commit [35cef22](https://github.com/xwikisas/application-confluence-migrator-pro/commit/36cef2271bd429773698ca3a21e47b6d51d6377d)</p> <p>### Workarounds There are no known workarounds besides upgrading.</p> <p>### References No references.</p> <p><strong>Affected:</strong> Maven: com.xwiki.confluencepro:application-confluence-migrator-pro-ui</p> <p>### Impact A user that doesn&#39;t have programming rights can execute arbitrary code when creating a page using the Migration Page template. A possible attack vector is the following: * Create a page and add the following content: ``` confluencepro.job.question.advanced.input={{/html}} {{async async=&#34;true&#34; cached=&#34;false&#34; context=&#34;doc.reference&#34;}}{{groovy}}println(&#34;hello from groovy!&#34;){{/groovy}}{{/async}} ``` * Use the object editor to add an object of type `XWiki.TranslationDocumentClass` with scope `USER`. * Access an unexisting page using the `MigrationTemplate` ``` http://localhost:8080/xwiki/bin/edit/Page123?template=ConfluenceMigratorPro.Code.MigrationTemplate ``` It is expected that `{{/html}} {{async async=&#34;true&#34; cached=&#34;false&#34; context=&#34;doc.reference&#34;}}{{groovy}}println(&#34;hello from groovy!&#34;){{/groovy}}{{/async}}` will be present on the page, however, `hello from groovy` will be printed. ### Patches The issue will be fixed as part of v1.2. The fix was added with commit [35cef22](https://github.com/xwikisas/application-confluence-migrator-pro/commit/36cef2271bd429773698ca3a21e47b6d51d6377d)</p> <p>### Workarounds There are no known workarounds besides upgrading.</p> <p>### References No references.</p> https://cve.radiocsirt.org/vuln/ghsa-6qvp-39mm-95v8