xwiki xwiki-commons

• CVE-2026-23734 Critical 9.3 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash 18.5%
• CVE-2024-31996 Critical 10.0 XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution 2.1%
• CVE-2023-36471 Critical 9.1 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml 1.0%
• CVE-2023-31126 Critical 9.1 Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml 0.8%
• CVE-2023-29528 Critical 9.1 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml 1.3%
• CVE-2023-29201 Critical 9.1 org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability 1.2%
• CVE-2023-26055 Critical 10.0 XWiki Commons may allow privilege escalation to programming rights via user's first name 1.2%
• CVE-2022-24897 High 7.5 Arbitrary filesystem write access from Velocity 1.8%
• CVE-2022-24898 Medium 4.9 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml 1.5%