Xwikisas vulnerabilities
We track 14 vulnerabilities in Xwikisas products across 4 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest Xwikisas vulnerabilities
- 9.9 Critical severity
xwiki-pro-macros: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's r
- 8.3 High severity
xwiki-pro-macros: Missing Authorization
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vuln
- 10.0 Critical severity
xwiki-pro-macros: Improper Encoding or Escaping of Output
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the title in the confluence paste code macro allows remote code execution for a
- 10.0 Critical severity
xwiki-pro-macros: Improper Encoding or Escaping of Output
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the ac:type in the ConfluenceLayoutSection macro allows remote code execution f
- 9.8 Critical severity
xwiki-pro-macros: Improper Control of Generation of Code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any u
- 9.8 Critical severity
xwiki-pro-macros: Improper Control of Generation of Code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any us
- 7.5 High severity
application-confluence-migrator-pro: Exposure of Sensitive Information to an Unauthorized Actor
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed i
- 9.1 Critical severity
application-confluence-migrator-pro: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. T
- 9.0 Critical severity
macro-pdfviewer: Improper Neutralization of Input During Web Page Generation
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole
- 7.5 High severity
macro-pdfviewer: Generation of Predictable Numbers or Identifiers
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the diges
- 7.5 High severity
macro-pdfviewer: Inclusion of Sensitive Information in Source Code Comments
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachme
- 8.8 High severity
xwiki-pro-macros: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerab
- 7.7 High severity
macro-pdfviewer: Exposure of Sensitive Information to an Unauthorized Actor
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can
- 9.6 Critical severity
identity-oauth: Improper Neutralization of Input During Web Page Generation
com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site