GHSA-7vpr-jm38-wr7w
NoneCVSS
—
EPSS
—
Published
Dec 10, 2025
CISA due date
—
The record
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-flamingo-skin-resources | 17.0.0-rc-1 | 17.4.2 |
| Maven | org.xwiki.platform:xwiki-platform-flamingo-skin-resources | 6.2-milestone-1 | 16.10.10 |
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 17.0.0-rc-1 | 17.4.2 |
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 6.2-milestone-1 | 16.10.10 |
| maven | org.xwiki.platform/xwiki-platform-flamingo-skin-resources | 17.0.0-rc-1 | 17.4.2 |
| maven | org.xwiki.platform/xwiki-platform-flamingo-skin-resources | 6.2-milestone-1 | 16.10.10 |
| maven | org.xwiki.platform/xwiki-platform-web-templates | 17.0.0-rc-1 | 17.4.2 |
| maven | org.xwiki.platform/xwiki-platform-web-templates | 6.2-milestone-1 | 16.10.10 |
Related vulnerabilities
- CVE-2025-66472 XWiki Platform is a generic wiki platform offering runtime services for applications… Same vulnerability
- CVE-2026-24128 XWiki Platform is a generic wiki platform offering runtime services for applications… Also affects org.xwiki.platform:xwiki-platform-web-templates
- GHSA-wvqx-m5px-6cmp XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages Also affects org.xwiki.platform:xwiki-platform-web-templates
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79