Apache Jspwiki
24 CVEs affecting Apache Jspwiki. Latest disclosed: 2025-07-31. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44140 | Critical | 9.1 | 2021-11-24 | Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logou… |
CVE-2022-34158 | High | 8.8 | 2022-08-04 | A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege esc… |
CVE-2022-24947 | High | 8.8 | 2022-02-25 | Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later. |
CVE-2025-24853 | High | 7.5 | 2025-07-31 | A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's br… |
CVE-2019-0225 | High | 7.5 | 2019-03-28 | A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by… |
CVE-2022-28731 | Medium | 6.5 | 2022-08-04 | A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modif… |
CVE-2025-24854 | Medium | 6.1 | 2025-07-31 | A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript… |
CVE-2024-27136 | Medium | 6.1 | 2024-06-24 | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information abo… |
CVE-2022-46907 | Medium | 6.1 | 2023-05-25 | A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascri… |
CVE-2022-28732 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the v… |
CVE-2022-28730 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in th… |
CVE-2022-27166 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attack… |
CVE-2022-24948 | Medium | 6.1 | 2022-02-25 | A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could a… |
CVE-2021-40369 | Medium | 6.1 | 2021-11-24 | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker… |
CVE-2019-12407 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the rem… |
CVE-2019-10090 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the pla… |
CVE-2019-12404 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoCon… |
CVE-2019-10089 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYS… |
CVE-2019-10087 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Pag… |
CVE-2019-10078 | Medium | 6.1 | 2019-05-20 | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Init… |