This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2023-26477 | BDVDB-2026-196623 Detail

xwikixwiki-platform

Description#

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.