CVE-2025-65036

HighCVSS 8.3/10Last modified Sep 25, 2026

Description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Dec 5, 2025
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-6503710.0Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a net CVE-2025-65048.4In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since CVE-2025-650419.8Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2025-650463.1Microsoft Edge (Chromium-based) Spoofing Vulnerability CVE-2025-65058.1Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux CVE-2025-65079.8A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrar CVE-2025-650737.5OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Ke CVE-2025-650747.2WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650756.5WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650766.1WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650778.8A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabili CVE-2025-650789.3An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabilit