xwiki-pro-macros vulnerabilities
7 known vulnerabilities in xwiki-pro-macros from Xwikisas. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
xwiki-pro-macros: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's r
- 8.3 High severity
xwiki-pro-macros: Missing Authorization
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vuln
- 10.0 Critical severity
xwiki-pro-macros: Improper Encoding or Escaping of Output
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the title in the confluence paste code macro allows remote code execution for a
- 10.0 Critical severity
xwiki-pro-macros: Improper Encoding or Escaping of Output
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the ac:type in the ConfluenceLayoutSection macro allows remote code execution f
- 9.8 Critical severity
xwiki-pro-macros: Improper Control of Generation of Code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any u
- 9.8 Critical severity
xwiki-pro-macros: Improper Control of Generation of Code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any us
- 8.8 High severity
xwiki-pro-macros: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerab