CVE-2023-26055

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-150

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-260565.4XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another CVE-2023-260576.5An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a CVE-2023-260586.5An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a prope CVE-2023-260595.4An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when pr CVE-2023-26064.8The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-260608.8An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that h CVE-2023-260615.4An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can crea CVE-2023-260627.8A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user ca CVE-2023-260639.8Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.CVE-2023-260649.8Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write.CVE-2023-260659.8Certain Lexmark devices through 2023-02-19 have an Integer Overflow.CVE-2023-260669.8Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.