Remote code execution as guest via SolrSearchMacros request in xwiki

XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

XWiki Platform vulnerable to HQL injection via wiki and space search REST API

XWiki Platform's configuration files can be accessed through the webjars API

XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

The XWiki Jetty package (XJetty) allows accessing any application file through URL

XWiki Platform's configuration files can be accessed through jsx and sx endpoints

XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

XWiki Platform: Privilege escalation from edit to script right through Live Data editing

XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality

XWiki Platform affected by click-jacking through CSS injection in comments

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform document history including authors of any page exposed to unauthorized actors