xwiki change request vulnerabilities

Latest xwiki change request CVEs

Newest publication first

1. CVE-2023-49280 Data leak of password hash through xwiki change request

   Published 2023-12-04

   Medium·CVSS 6.5 EPSS 0.94%

   XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes. Change request allows to edit any page by default, and the changes are then exported in an XML file that anyone can download. So it's possible for an attack...

2. CVE-2023-45138 Change Request Application vulnerable to XSS and remote code execution through change request title

   Published 2023-10-12

   Critical·CVSS 9.6 EPSS 71.7%

   Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.