Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55695 State: PUBLISHED Published: 2025-10-14T17:01:12.120Z Last Updated: 2025-11-22T04:09:16.428Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-125 Description: Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally. Addition
-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55695
CVE ID: CVE-2025-55696 State: PUBLISHED Published: 2025-10-14T17:01:12.774Z Last Updated: 2025-11-22T04:09:16.965Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 11 Version 25H2 Problem Types: CWE-367, CWE-822 Description: Time-o
indows 11 Version 24H2, Windows Server 2025, Windows 11 Version 25H2 Problem Types: CWE-367, CWE-822 Description: Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs.h) allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55696
CVE ID: CVE-2025-55697 State: PUBLISHED Published: 2025-10-14T17:01:13.464Z Last Updated: 2025-11-22T04:09:17.584Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025 Problem Types: CWE-122 Description: Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55697
CVE ID: CVE-2025-55698 State: PUBLISHED Published: 2025-10-14T17:01:14.087Z Last Updated: 2025-11-22T04:09:18.215Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-476 Description: Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55698
CVE ID: CVE-2025-55699 State: PUBLISHED Published: 2025-10-14T17:01:14.745Z Last Updated: 2025-11-22T04:09:18.860Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55699
CVE ID: CVE-2025-55700 State: PUBLISHED Published: 2025-10-14T17:00:22.479Z Last Updated: 2025-11-22T04:08:29.646Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-125 Description: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information
-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55700
CVE ID: CVE-2025-55701 State: PUBLISHED Published: 2025-10-14T17:00:23.119Z Last Updated: 2025-11-22T04:08:30.196Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607,
ver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-1287 Description: Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally
r validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55701
CVE ID: CVE-2025-55706 State: PUBLISHED Published: 2025-08-20T04:23:01.512Z Last Updated: 2025-08-20T15:57:41.631Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Six Apart Ltd. Products: Movable Type (Software Edition), Movable Type Advanced (Software Edition), Movable Type Premium (Software Edition), Movable Type Premium (Advanced Edition) (Software Edition), Movable Type (Cloud Edition), Movable Type Premium (Cloud Edition) Problem Types: CWE-601 Description: URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead
e. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://movabletype.org/news/2025/08/mt-843-released.html - https://jvn.jp/en/jp/JVN76729865/
CVE ID: CVE-2025-55708 State: PUBLISHED Published: 2025-08-14T18:21:34.645Z Last Updated: 2025-08-15T12:53:38.645Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: ExpressTech Systems Products: Quiz And Survey Master Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master allows SQL Injection. This issue affects Quiz And Survey Master: from n/a through 10.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plug
- https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-plugin-10-2-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-55709 State: PUBLISHED Published: 2025-08-14T18:21:31.435Z Last Updated: 2025-08-15T12:53:53.773Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Visual Composer Products: Visual Composer Website Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. This issue affects Visual Composer Website Builder: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-compose
nt: References: - https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-plugin-45-15-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-55710 State: PUBLISHED Published: 2025-08-14T18:21:29.824Z Last Updated: 2025-08-14T19:35:17.264Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Steve Burge Products: TaxoPress Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress allows Retrieve Embedded Sensitive Data. This issue affects TaxoPress: from n/a through 3.37.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-tags/vulnerability/wordpress-taxopress-plugin-plugin-3-37-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-55711 State: PUBLISHED Published: 2025-08-14T18:21:28.502Z Last Updated: 2025-08-14T19:35:47.248Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Table Builder Products: WP Table Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder allows Stored XSS. This issue affects WP Table Builder: from n/a through 2.0.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-table-builder/vulnerability/wordpress-wp-table-builder-plugin-plugin-2-0-12-cross-site-scr
/database/wordpress/plugin/wp-table-builder/vulnerability/wordpress-wp-table-builder-plugin-plugin-2-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-55712 State: PUBLISHED Published: 2025-08-14T18:21:26.040Z Last Updated: 2025-08-14T19:36:14.136Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: POSIMYTH Products: The Plus Addons for Elementor Page Builder Lite Problem Types: CWE-862 Description: Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.3.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elem
Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-plugin-6-3-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-55713 State: PUBLISHED Published: 2025-08-14T18:21:25.460Z Last Updated: 2025-08-14T19:36:36.055Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: CreativeThemes Products: Blocksy Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeThemes Blocksy allows Stored XSS. This issue affects Blocksy: from n/a through 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/blocksy/vulnerability/wordpress-blocksy-theme-theme-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-55714 State: PUBLISHED Published: 2025-08-14T18:21:24.869Z Last Updated: 2025-08-14T19:36:58.769Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor allows Stored XSS. This issue affects JetElements For Elementor: from n/a through 2.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-plugin-2-
patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-plugin-2-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-55715 State: PUBLISHED Published: 2025-08-20T08:02:49.588Z Last Updated: 2025-08-20T17:19:02.931Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Themeisle Products: Otter - Gutenberg Block Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block allows Retrieve Embedded Sensitive Data. This issue affects Otter - Gutenberg Block: from n/a through 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/otter-blocks/vulnerability/wordpress-otter-gutenberg-block-plugin-3-1-0-sensitive-data-exposure-vulne
e/wordpress/plugin/otter-blocks/vulnerability/wordpress-otter-gutenberg-block-plugin-3-1-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-55716 State: PUBLISHED Published: 2025-08-14T18:21:23.962Z Last Updated: 2025-08-15T12:54:10.346Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: VeronaLabs Products: WP Statistics Problem Types: CWE-862 Description: Missing Authorization vulnerability in VeronaLabs WP Statistics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Statistics: from n/a through 14.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-statistics/vulnerability/wordpress-wp-statistics-plugin-plugin-14-15-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-55718 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:09.251Z Description: No description available.
CVE ID: CVE-2025-55719 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:08.812Z Description: No description available.
CVE ID: CVE-2025-55720 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:08.353Z Description: No description available.
CVE ID: CVE-2025-55721 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:07.837Z Description: No description available.
CVE ID: CVE-2025-55722 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:07.380Z Description: No description available.
CVE ID: CVE-2025-55723 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:06.893Z Description: No description available.
CVE ID: CVE-2025-55724 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:06.452Z Description: No description available.
CVE ID: CVE-2025-55725 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:05.944Z Description: No description available.
CVE ID: CVE-2025-55726 State: REJECTED Published: N/A Last Updated: 2025-08-15T02:55:05.403Z Description: No description available.
CVE ID: CVE-2025-55727 State: PUBLISHED Published: 2025-09-09T18:31:08.108Z Last Updated: 2025-09-10T14:14:06.852Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: xwikisas Products: xwiki-pro-macros Problem Types: CWE-95 Description: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any user who can edit any page or who can access the CKEditor converter. The width parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which
itor converter. The width parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution when the macro has been installed by a user with programming right, or it at least allows executing Velocity code as the wiki admin. Version 1.26.5 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-hxqp-983c-m8h9 - https://github.com/xwikisas/xwiki-pro-macros/commit/05651adb4b58d03ba862d5290c645feeffd2121b - https://github.com/xwikisas/xwiki-pro-macros/blob/aed17fa3db4081846dbb6bdf76ba10cf44401c44/xwiki-pro-macros-ui/src/main/re
tps://github.com/xwikisas/xwiki-pro-macros/blob/aed17fa3db4081846dbb6bdf76ba10cf44401c44/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Column.xml#L438
CVE ID: CVE-2025-55728 State: PUBLISHED Published: 2025-09-09T18:40:51.874Z Last Updated: 2025-09-11T13:15:28.508Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: xwikisas Products: xwiki-pro-macros Problem Types: CWE-95 Description: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version
used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 - https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 - https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 - https://jira.xwiki.org/browse/XWIKI-20449
CVE ID: CVE-2025-55729 State: PUBLISHED Published: 2025-09-09T18:51:47.265Z Last Updated: 2025-09-10T13:55:00.520Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: xwikisas Products: xwiki-pro-macros Problem Types: CWE-116 Description: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the ac:type in the ConfluenceLayoutSection macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution
meter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 has a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-22xj-jpjg-gpgw - https://github.com/xwikisas/xwiki-pro-macros/commit/06e6cf3893227527d0242a11e390642178d9df05 - https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-confluence-bridges/xwiki-pro-macros-confluence-bridges-ui/src/main/resources/Confluence/Macros/ConfluenceLayoutSection.xml#L518 - https://jira.xwiki.org/browse/XWIKI-20449
CVE ID: CVE-2025-55730 State: PUBLISHED Published: 2025-09-09T18:53:53.410Z Last Updated: 2025-09-10T13:53:06.252Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: xwikisas Products: xwiki-pro-macros Problem Types: CWE-116 Description: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the title in the confluence paste code macro allows remote code execution for any user who can edit any page. The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. V
er is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 has a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-5w8v-h22g-j2mp - https://github.com/xwikisas/xwiki-pro-macros/commit/049716df415aaf00938a91d618d382777820d2af - https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-confluence-bridges/xwiki-pro-macros-confluence-bridges-ui/src/main/resources/Confluence/Macros/ConfluencePasteCodeMacro.xml#L435 - https://jira.xwiki.org/browse/XWIKI-20449