Jspwiki (Apache) - vulnerabilities (CVEs)

29 CVEs, 0 in the last 30 days, 120 known versions, newest CVE from 2026-07-30. Vendor: Apache.

CVEs of Jspwiki

CVE-2026-48910 - CVSS 6.5 (medium), 2026-07-30: A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the…
CVE-2026-28814 - CVSS 7.5 (high), 2026-07-30: Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki…
CVE-2026-28813 - CVSS 8.8 (high), 2026-07-30: Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which…
CVE-2026-28812 - CVSS 9.8 (critical), 2026-07-30: UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to…
CVE-2026-28811 - CVSS 7.5 (high), 2026-07-30: Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
CVE-2025-24854 - CVSS 6.1 (medium), 2025-07-31: A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript…
CVE-2025-24853 - CVSS 7.5 (high), 2025-07-31: A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's…
CVE-2024-27136 - CVSS 6.1 (medium), 2024-06-24: XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information…
CVE-2022-46907 - CVSS 6.1 (medium), 2023-05-25: A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute…
CVE-2022-34158 - CVSS 8.8 (high), 2022-08-04: A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege…
CVE-2022-27166 - CVSS 6.1 (medium), 2022-08-04: A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the…
CVE-2022-28732 - CVSS 6.1 (medium), 2022-08-04: A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the…
CVE-2022-28731 - CVSS 6.5 (medium), 2022-08-04: A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to…
CVE-2022-28730 - CVSS 6.1 (medium), 2022-08-04: A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in…
CVE-2022-24948 - CVSS 6.1 (medium), 2022-02-25: A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could…
CVE-2022-24947 - CVSS 8.8 (high), 2022-02-25: Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
CVE-2021-44140 - CVSS 9.1 (critical), 2021-11-24: Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on…
CVE-2021-40369 - CVSS 6.1 (medium), 2021-11-24: A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the…
CVE-2019-10090 - CVSS 6.1 (medium), 2019-09-23: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…
CVE-2019-12407 - CVSS 6.1 (medium), 2019-09-23: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…
CVE-2019-10087 - CVSS 6.1 (medium), 2019-09-23: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…
CVE-2019-12404 - CVSS 6.1 (medium), 2019-09-23: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to…
CVE-2019-10089 - CVSS 6.1 (medium), 2019-09-23: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…
CVE-2019-10076 - CVSS 6.1 (medium), 2019-05-20: A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10078 - CVSS 6.1 (medium), 2019-05-20: A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.…
CVE-2019-10077 - CVSS 6.1 (medium), 2019-05-20: A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-0225 - CVSS 7.5 (high), 2019-03-28: A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by…
CVE-2019-0224 - CVSS 6.1 (medium), 2019-03-28: In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server…
CVE-2018-20242 - CVSS 6.1 (medium), 2019-02-11: A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.