Apache Jspwiki
29 CVEs affecting Apache Jspwiki. Latest disclosed: 2026-07-30. Critical: 2, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28812 | Critical | 9.8 | 2026-07-30 | UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgra… |
CVE-2021-44140 | Critical | 9.1 | 2021-11-24 | Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logou… |
CVE-2026-28813 | High | 8.8 | 2026-07-30 | Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which f… |
CVE-2022-34158 | High | 8.8 | 2022-08-04 | A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege esc… |
CVE-2022-24947 | High | 8.8 | 2022-02-25 | Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later. |
CVE-2026-28814 | High | 7.5 | 2026-07-30 | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variabl… |
CVE-2026-28811 | High | 7.5 | 2026-07-30 | Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue. |
CVE-2025-24853 | High | 7.5 | 2025-07-31 | A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's br… |
CVE-2019-0225 | High | 7.5 | 2019-03-28 | A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by… |
CVE-2026-48910 | Medium | 6.5 | 2026-07-30 | A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the… |
CVE-2022-28731 | Medium | 6.5 | 2022-08-04 | A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modif… |
CVE-2025-24854 | Medium | 6.1 | 2025-07-31 | A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript… |
CVE-2024-27136 | Medium | 6.1 | 2024-06-24 | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information abo… |
CVE-2022-46907 | Medium | 6.1 | 2023-05-25 | A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascri… |
CVE-2022-28732 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the v… |
CVE-2022-28730 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in th… |
CVE-2022-27166 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attack… |
CVE-2022-24948 | Medium | 6.1 | 2022-02-25 | A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could a… |
CVE-2021-40369 | Medium | 6.1 | 2021-11-24 | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker… |
CVE-2019-12407 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the rem… |