Apache Jspwiki (Apache Software Foundation) - vulnerabilities (CVEs)
22 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-07-30. Vendor: Apache Software Foundation.
CVEs of Apache Jspwiki
- CVE-2026-48910 - CVSS 6.5 (medium), 2026-07-30: A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the…
- CVE-2026-28814 - CVSS 7.5 (high), 2026-07-30: Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki…
- CVE-2026-28813 - CVSS 8.8 (high), 2026-07-30: Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which…
- CVE-2026-28812 - CVSS 9.8 (critical), 2026-07-30: UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to…
- CVE-2026-28811 - CVSS 7.5 (high), 2026-07-30: Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
- CVE-2025-24854 - CVSS 6.1 (medium), 2025-07-31: A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript…
- CVE-2025-24853 - CVSS 7.5 (high), 2025-07-31: A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's…
- CVE-2024-27136 - CVSS 6.1 (medium), 2024-06-24: XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information…
- CVE-2022-46907 - CVSS 6.1 (medium), 2023-05-25: A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute…
- CVE-2022-28732 - CVSS 6.1 (medium), 2022-08-04: A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the…
- CVE-2022-28731 - CVSS 6.5 (medium), 2022-08-04: A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to…
- CVE-2022-28730 - CVSS 6.1 (medium), 2022-08-04: A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in…
- CVE-2022-34158 - CVSS 8.8 (high), 2022-08-04: A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege…
- CVE-2022-27166 - CVSS 6.1 (medium), 2022-08-04: A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the…
- CVE-2022-24948 - CVSS 6.1 (medium), 2022-02-25: A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could…
- CVE-2022-24947 - CVSS 8.8 (high), 2022-02-25: Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- CVE-2021-40369 - CVSS 6.1 (medium), 2021-11-24: A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the…
- CVE-2021-44140 - CVSS 9.1 (critical), 2021-11-24: Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on…
- CVE-2019-10076 - CVSS 6.1 (medium), 2019-05-20: A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
- CVE-2019-10078 - CVSS 6.1 (medium), 2019-05-20: A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.…
- CVE-2019-10077 - CVSS 6.1 (medium), 2019-05-20: A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
- CVE-2018-20242 - CVSS 6.1 (medium), 2019-02-11: A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
