Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
XWikiplatform Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-66472 - Vulnerability Database
XWikiplatform

XWikiplatform Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-66472

Medium
Reference: CVE-2025-66472
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-66472
Title: XWikiplatform Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the quotNoquot button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.