WaratekVRT Sign in

Critical CWE-80 CVEs

6 CVEs, 1 exploited

Reset
More filters (1)
Columns
CWE CWE-80✕
Overview 6 matches · 0 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
6matches 0protected0.0% 1exploited16.7% 0CISA KEV0.0% 2public PoC33.3% 2EPSS ≥ 0.533.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 33.3% No exploit published 4 66.7%
Critical 6 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 16.7% Working exploit published 1 16.7% Proof of concept only 3 50.0% Forecast only 1 16.7% No public exploit 0 0.0%
split by peak 2 / quarter
No exploit published: 4Mitigation candidate: 2 Critical: 6 not blocked: 6 Forecast only: 1Proof of concept only: 3Working exploit published: 1Exploited: 1
Q3 222 No exploit published2 Critical2 not blocked2 Proof of concept only1 Forecast only1 Q4 220 Q1 230 Q2 231 No exploit published1 Critical1 not blocked1 Proof of concept only1 Q3 230 Q4 231 Mitigation candidate1 Critical1 not blocked1 Exploited1 Q1 240 Q2 240 Q3 241 Mitigation candidate1 Critical1 not blocked1 Working exploit published1 Q4 240 Q1 250 Q2 250 Q3 251 No exploit published1 Critical1 not blocked1 Proof of concept only1
Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-53835 Critical 2025-07-14 No exploit published Proof of concept only XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.
CVE-2024-41947 Critical 2024-07-31 Mitigation candidate Working exploit published XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.
CVE-2023-46732 Critical 2023-11-06 Mitigation candidate Exploited XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.
CVE-2023-35153 Critical 2023-06-23 No exploit published Proof of concept only XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update `AppWithinMinutes.ClassEditSheet` with a patch.
CVE-2022-36096 Critical 2022-09-08 No exploit published Forecast only The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.
CVE-2022-36094 Critical 2022-09-08 No exploit published Proof of concept only XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.