CVE-2023-36471
CriticalCVSS 9.0Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
XWiki commons had a vulnerability in HTML sanitization that allowed the use of form and input tags. An attacker could create phishing forms or inject malicious code that could be executed by an admin.
Risk Assessment
The organization may be exposed to phishing attacks and remote code execution, potentially leading to data loss or system takeover.
Recommendation
It is recommended to upgrade to XWiki version 14.10.6 or 15.2RC1. Alternatively, administrators can block unsafe tags in the `xwiki.properties` configuration file.
Related vulnerabilities
- CVE-2026-71377Critical
Command argument injection vulnerability in Cosminexus Component Container. Allows an attacker to execute unauthorized system commands.
- CVE-2026-71376Critical
OS command injection vulnerability in Cosminexus Component Container. Allows an attacker to execute arbitrary commands on the server.
- CVE-2026-62645Critical
Vulnerability in Reyrolle 7SR5 exposes information through the web interface that can be used to calculate current and past session ID numbers. An attacker could bypass authentication and gain unauthorized access to the device.
- CVE-2026-50093Critical
Vulnerability in the OIS web module of Siveillance Control allows an attacker to upload arbitrary files to the server. Successful exploitation could allow an attacker to gain root access on the host system, potentially leading to full compromise of the OIS environment.
- CVE-2026-71374Critical
Deserialization of untrusted data vulnerability in Cosminexus Component Container. Could allow an attacker to execute arbitrary code or cause a crash.
- CVE-2026-86510Critical
The D-Link DIR-822A router version A_101 has a vulnerability in the tunnel_set_params function of the L2TP Control Message Parser component, leading to an out-of-bounds write. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-86509Critical
The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.
- CVE-2026-76969Critical
The @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application, and partial impact on confidentiality of business data.
- CVE-2026-66768Critical
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on confidentiality, integrity, and availability.
- CVE-2026-58240Critical
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access could register an unauthorized component and potentially perform unauthorized actions, resulting in high impact on confidentiality, integrity, and availability.
Original NVD description (English source)
Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println("Hello from Groovy!")" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.