Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49554 State: PUBLISHED Published: 2025-08-12T17:55:07.283Z Last Updated: 2025-08-13T20:14:23.568Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-20 Description: Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction. Additional Analyst Notes:
o crash or become unresponsive. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-71.html
CVE ID: CVE-2025-49555 State: PUBLISHED Published: 2025-08-12T17:55:05.453Z Last Updated: 2025-08-13T20:14:36.081Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-352 Description: Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim into executing unintended actions on a web application where the victim is authenticated, potentially allowing unauthorized access or modification of sensitive data. Exploitation
e the victim is authenticated, potentially allowing unauthorized access or modification of sensitive data. Exploitation of this issue requires user interaction in that a victim must visit a malicious website or click on a crafted link. Scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-71.html
CVE ID: CVE-2025-49556 State: PUBLISHED Published: 2025-08-12T17:55:11.081Z Last Updated: 2025-08-13T20:14:11.184Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is unchanged. Additional Analyst Notes: - CISA ADP
ploitation of this issue does not require user interaction, and scope is unchanged. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-71.html
CVE ID: CVE-2025-49557 State: PUBLISHED Published: 2025-08-12T17:55:09.849Z Last Updated: 2025-08-22T16:30:34.701Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue require
chieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-71.html
CVE ID: CVE-2025-49558 State: PUBLISHED Published: 2025-08-12T17:55:08.951Z Last Updated: 2025-08-13T18:57:01.774Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-367 Description: Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability by manipulating the timing between the check of a resource's state and its use, allowing unauthorized write access. Exploitation of this issue does not require
check of a resource's state and its use, allowing unauthorized write access. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-71.html
CVE ID: CVE-2025-49559 State: PUBLISHED Published: 2025-08-12T17:55:06.460Z Last Updated: 2025-08-13T20:14:29.593Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-22 Description: Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to modify limited data. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnri
limited data. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-71.html
CVE ID: CVE-2025-49560 State: PUBLISHED Published: 2025-08-12T20:07:59.593Z Last Updated: 2025-08-13T15:04:41.180Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Viewer Problem Types: CWE-122 Description: Substance3D - Viewer versions 0.25 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-72.html
CVE ID: CVE-2025-49561 State: PUBLISHED Published: 2025-08-12T20:25:41.981Z Last Updated: 2025-08-14T03:56:04.406Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Animate Problem Types: CWE-416 Description: Animate versions 23.0.12, 24.0.9 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/animate/apsb25-73.html
CVE ID: CVE-2025-49562 State: PUBLISHED Published: 2025-08-12T20:25:42.789Z Last Updated: 2025-08-12T20:53:27.659Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Animate Problem Types: CWE-416 Description: Animate versions 23.0.12, 24.0.9 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/animate/apsb25-73.html
CVE ID: CVE-2025-49563 State: PUBLISHED Published: 2025-08-12T17:01:53.071Z Last Updated: 2025-08-13T15:04:04.828Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator versions 28.7.8, 29.6.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-74.html
CVE ID: CVE-2025-49564 State: PUBLISHED Published: 2025-08-12T17:01:51.517Z Last Updated: 2025-08-13T15:04:06.179Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-121 Description: Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-74.html
CVE ID: CVE-2025-49567 State: PUBLISHED Published: 2025-08-12T17:01:50.749Z Last Updated: 2025-08-12T18:03:44.969Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-476 Description: Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.ado
a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-74.html
CVE ID: CVE-2025-49568 State: PUBLISHED Published: 2025-08-12T17:01:52.298Z Last Updated: 2025-08-12T18:03:13.812Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Illustrator Problem Types: CWE-416 Description: Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-74.html
CVE ID: CVE-2025-49569 State: PUBLISHED Published: 2025-08-12T20:08:01.433Z Last Updated: 2025-08-13T15:04:42.399Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Viewer Problem Types: CWE-787 Description: Substance3D - Viewer versions 0.25 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-72.html
CVE ID: CVE-2025-49570 State: PUBLISHED Published: 2025-08-12T20:29:35.794Z Last Updated: 2025-08-13T15:04:46.232Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Desktop Problem Types: CWE-787 Description: Photoshop Desktop versions 25.12.3, 26.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb25-75.html
CVE ID: CVE-2025-49571 State: PUBLISHED Published: 2025-08-12T20:36:07.533Z Last Updated: 2025-08-13T20:12:59.292Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Modeler Problem Types: CWE-427 Description: Substance3D - Modeler versions 1.22.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses an uncontrolled search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploita
uld modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html
CVE ID: CVE-2025-49572 State: PUBLISHED Published: 2025-08-12T20:36:13.322Z Last Updated: 2025-08-14T03:56:05.625Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Modeler Problem Types: CWE-787 Description: Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html
CVE ID: CVE-2025-49573 State: PUBLISHED Published: 2025-08-12T20:36:14.108Z Last Updated: 2025-08-14T03:56:06.741Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Modeler Problem Types: CWE-787 Description: Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html
CVE ID: CVE-2025-49574 State: PUBLISHED Published: 2025-06-23T19:47:05.454Z Last Updated: 2025-06-24T13:33:07.194Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: quarkusio Products: quarkus Problem Types: CWE-668 Description: Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.0, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the beh
nsaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4 - https://github.com/quarkusio/quarkus/issues/48227 - https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1
CVE ID: CVE-2025-49575 State: PUBLISHED Published: 2025-06-12T18:45:23.363Z Last Updated: 2025-06-12T18:58:25.445Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: StarCitizenTools Products: mediawiki-skins-Citizen Problem Types: CWE-79 Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. Additional Analyst Notes: - CISA ADP
erface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-4c2h-67qq-vm87 - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4fa69e1d062dca7e407cc0530cf1da3e2baaf0b5 - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd
CVE ID: CVE-2025-49576 State: PUBLISHED Published: 2025-06-12T18:50:55.931Z Last Updated: 2025-06-12T19:05:48.122Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: StarCitizenTools Products: mediawiki-skins-Citizen Problem Types: CWE-79 Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenTool
y is fixed in 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-86xf-2mgp-gv3g - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a0296afaedbe1a277337a2d8f1da83cb3a79b9ab
CVE ID: CVE-2025-49577 State: PUBLISHED Published: 2025-06-12T18:45:18.415Z Last Updated: 2025-06-12T19:01:58.426Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: StarCitizenTools Products: mediawiki-skins-Citizen Problem Types: CWE-79 Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jwr7-
P Vulnrichment: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jwr7-992g-68mh - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a741639085d70c22a9f49890542a142a223bf981
CVE ID: CVE-2025-49578 State: PUBLISHED Published: 2025-06-12T18:50:49.300Z Last Updated: 2025-06-12T19:12:17.575Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: StarCitizenTools Products: mediawiki-skins-Citizen Problem Types: CWE-79 Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. Additional Analyst Notes: - CISA AD
nterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd
CVE ID: CVE-2025-49579 State: PUBLISHED Published: 2025-06-12T18:50:44.360Z Last Updated: 2025-06-12T19:16:43.720Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: StarCitizenTools Products: mediawiki-skins-Citizen Problem Types: CWE-79 Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. Additional Analyst Not
as the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g3cp-pq72-hjpv - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/54c8717d45ce1594918f11cb9ce5d0ccd8dfee65 - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd
CVE ID: CVE-2025-49580 State: PUBLISHED Published: 2025-06-13T15:45:58.451Z Last Updated: 2025-06-13T18:09:04.665Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-266 Description: XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43
lyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6 - https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec - https://jira.xwiki.org/browse/XWIKI-22836
CVE ID: CVE-2025-49581 State: PUBLISHED Published: 2025-06-13T16:09:22.997Z Last Updated: 2025-06-13T16:29:33.031Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-94, CWE-270, CWE-250 Description: XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter allows wiki syntax, its default value is executed with the rights of the author of the document where it is used. This can be exploited by overriding a macro like the children macro that is us
author of the document where it is used. This can be exploited by overriding a macro like the children macro that is used in a page that has programming right like the page XWiki.ChildrenMacro and thus allows arbitrary script macros. This vulnerability has been patched in XWiki 16.4.7, 16.10.3 and 17.0.0 by executing wiki parameters with the rights of the wiki macro's author when the parameter's value is the default value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9875-cw22-f7cx - https://github.com/xwiki/xwiki-platform/commit/c99d501ed41cbee6a3c02ff927714531570789de - https://jira.xwiki.org/browse/XWIKI
://github.com/xwiki/xwiki-platform/commit/c99d501ed41cbee6a3c02ff927714531570789de - https://jira.xwiki.org/browse/XWIKI-22760