CVE-2023-26473

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264748.8XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author CVE-2023-264758.8XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a r CVE-2023-264767.5XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call CVE-2023-264779.8XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including CVE-2023-264788.1XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTe CVE-2023-264796.5XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handl CVE-2023-26489.8A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/u CVE-2023-264805.4XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripti CVE-2023-264816.5authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sen CVE-2023-264828.8Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workfl CVE-2023-264835.3gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely suscep CVE-2023-264848.2KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernete