CVE-2023-26474

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-264758.8XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a rCVE-2023-264767.5XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call CVE-2023-264779.8XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including CVE-2023-264788.1XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTeCVE-2023-264796.5XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handlCVE-2023-26489.8A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uCVE-2023-264805.4XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scriptiCVE-2023-264816.5authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or senCVE-2023-264828.8Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflCVE-2023-264835.3gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely suscepCVE-2023-264848.2KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a KuberneteCVE-2023-264857.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmar
CVE-2023-26474: High severity, CVSS 8.8 | Vulnix