Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:12:22 +0000 CVE-2025-53835 — XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax https://cve.radiocsirt.org/vuln/cve-2025-53835 <p><strong>Affected:</strong> xwiki-rendering</p> <p>XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it&#39;s main purpose is testing and its use is quite difficult, this syntax shouldn&#39;t be installed or used on a regular wiki. There are no known workarounds apart from upgrading.</p> <p><strong>Affected:</strong> xwiki-rendering</p> <p>XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it&#39;s main purpose is testing and its use is quite difficult, this syntax shouldn&#39;t be installed or used on a regular wiki. There are no known workarounds apart from upgrading.</p> https://cve.radiocsirt.org/vuln/cve-2025-53835