xwiki xwiki-rendering
7 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-53837 | < 14.10.2 | org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue | CRITICAL 9.9 | 1.5 % | ||
| CVE-2025-66474 | < 16.10.10 ; >= 17.0.0-rc-1, < 17.4.3 ; >= 17.5.0-rc-1, < 17.6.0-rc-1 | XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection | HIGH 8.7 | 1.0 % | ||
| CVE-2025-53836 | >= 4.2-milestone-1, < 13.10.11 ; >= 14.0, < 14.4.7 ; >= 14.5, < 14.10 | XWiki Rendering is vulnerable to RCE attacks when processing nested macros | CRITICAL 10.0 | 0.6 % | ||
| CVE-2025-53835 | >= 5.4.5, < 14.10 | XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax | CRITICAL 9.1 | 0.4 % | ||
| CVE-2023-37912 | < 14.10.6 ; >= 15.0-rc-1, < 15.1-rc-1 | XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro | CRITICAL 10.0 | 1.5 % | ||
| CVE-2023-37908 | >= 14.6-rc-1, < 14.10.4 | org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability | CRITICAL 9.6 | 1.1 % | ||
| CVE-2023-32070 | < 14.6-rc-1 ; <= 3.0-milestone-2 | Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers | CRITICAL 9.1 | 0.7 % |