{"id":13381,"date":"2025-08-18T16:52:24","date_gmt":"2025-08-18T16:52:24","guid":{"rendered":"http:\/\/localhost\/?p=13381"},"modified":"2025-08-18T16:52:24","modified_gmt":"2025-08-18T16:52:24","slug":"exploit-for-cross-site-scripting-in-xwiki-commons","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=13381","title":{"rendered":"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525"},"content":{"rendered":"<p>{&#8220;lastseen&#8221;:&#8221;2025-08-18T21:27:28&#8243;,&#8221;description&#8221;:&#8221;# XWiki Commons\\n\\n[XWiki Commons](http:\/\/commons.xwiki.org\/xwiki\/bin\/view\/Main\/) are technical libraries common to several other top level XWiki projects. \\n\\nThese libraries can be used by projects outside of the XWiki ecosystem, are generic and not related to the wiki domain.\\n\\nXWiki Platform, XWiki Commons and XWiki Rendering are part of the [XWiki.org](http:\/\/www.xwiki.org\/) software forge. They are released together and share the same version.\\n\\n## Documentation\\n* [Documentation](http:\/\/commons.xwiki.org\/)\\n* [API](http:\/\/platform.xwiki.org\/xwiki\/bin\/view\/DevGuide\/API)\\n* [Development Zone](http:\/\/dev.xwiki.org\/xwiki\/bin\/view\/Community\/)\\n\\n## Download\\nThe XWiki Commons JARs are available in the [![Maven Central Repository](https:\/\/img.shields.io\/maven-central\/v\/org.xwiki.commons\/xwiki-commons.svg?maxAge=3600)](http:\/\/search.maven.org\/#search|ga|1|g%3A%22org.xwiki.commons%22).\\n\\n## Release Notes\\nRead our [Release Notes](http:\/\/www.xwiki.org\/xwiki\/bin\/view\/ReleaseNotes\/).\\n\\n## Tools\\n* [Continuous Integration](http:\/\/ci.xwiki.org\/) setup launches a build for each commit\\n* [Issue Tracker](http:\/\/jira.xwiki.org\/browse\/XCOMMONS) if you want to report an issue\\n* [Development Flow](http:\/\/dev.xwiki.org\/xwiki\/bin\/view\/Community\/DevelopmentPractices#HGeneralDevelopmentFlow) to see the full list of tools we use to build XWiki\\n* [![Revved up by Gradle Enterprise](https:\/\/img.shields.io\/badge\/Revved%20up%20by-Gradle%20Enterprise-06A0CE?logo=Gradle\\u0026labelColor=02303A)](https:\/\/ge.xwiki.org\/scans)\\n\\n## Community\\nWe&#8217;re always looking for contributors! \\nYou should read our [Get Involved Guide](http:\/\/dev.xwiki.org\/xwiki\/bin\/view\/Community\/Contributing) or get in touch:\\n* [Blog](http:\/\/www.xwiki.org\/xwiki\/bin\/view\/Blog\/)\\n* [Forum](https:\/\/dev.xwiki.org\/xwiki\/bin\/view\/Community\/Discuss)\\n* [Chat](https:\/\/dev.xwiki.org\/xwiki\/bin\/view\/Community\/Chat)\\n&#8221;,&#8221;published&#8221;:&#8221;2025-08-16T14:32:44&#8243;,&#8221;modified&#8221;:&#8221;2025-08-16T14:34:10&#8243;,&#8221;type&#8221;:&#8221;githubexploit&#8221;,&#8221;title&#8221;:&#8221;Exploit for Cross-site Scripting in Xwiki Commons&#8221;,&#8221;source&#8221;:&#8221;&#8221;,&#8221;references&#8221;:&#8221;&#8221;,&#8221;id&#8221;:&#8221;6276B3AF-472D-5204-999D-C8E1355D5525&#8243;,&#8221;bulletinFamily&#8221;:&#8221;exploit&#8221;,&#8221;cwe&#8221;:null,&#8221;cvelist&#8221;:[&#8220;CVE-2023-36471&#8243;],&#8221;sourceData&#8221;:&#8221;&#8221;,&#8221;sourceHref&#8221;:&#8221;&#8221;,&#8221;cvss&#8221;:{&#8220;score&#8221;:9,&#8221;severity&#8221;:&#8221;CRITICAL&#8221;,&#8221;vector&#8221;:&#8221;CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:H\/I:H\/A:H&#8221;,&#8221;version&#8221;:&#8221;3.1&#8243;},&#8221;cvss2&#8243;:{},&#8221;cvss3&#8243;:{&#8220;version&#8221;:&#8221;&#8221;,&#8221;vectorString&#8221;:&#8221;&#8221;,&#8221;baseScore&#8221;:0,&#8221;baseSeverity&#8221;:&#8221;&#8221;,&#8221;attackVector&#8221;:&#8221;&#8221;,&#8221;attackComplexity&#8221;:&#8221;&#8221;,&#8221;privilegesRequired&#8221;:&#8221;&#8221;,&#8221;userInteraction&#8221;:&#8221;&#8221;,&#8221;scope&#8221;:&#8221;&#8221;,&#8221;confidentialityImpact&#8221;:&#8221;&#8221;,&#8221;integrityImpact&#8221;:&#8221;&#8221;,&#8221;availabilityImpact&#8221;:&#8221;&#8221;,&#8221;cvssV3&#8243;:{&#8220;version&#8221;:&#8221;&#8221;,&#8221;vectorString&#8221;:&#8221;&#8221;,&#8221;baseScore&#8221;:0,&#8221;baseSeverity&#8221;:&#8221;&#8221;,&#8221;attackVector&#8221;:&#8221;&#8221;,&#8221;attackComplexity&#8221;:&#8221;&#8221;,&#8221;privilegesRequired&#8221;:&#8221;&#8221;,&#8221;userInteraction&#8221;:&#8221;&#8221;,&#8221;scope&#8221;:&#8221;&#8221;,&#8221;confidentialityImpact&#8221;:&#8221;&#8221;,&#8221;integrityImpact&#8221;:&#8221;&#8221;,&#8221;availabilityImpact&#8221;:&#8221;&#8221;}},&#8221;href&#8221;:&#8221;https:\/\/github.com\/shoucheng3\/xwiki__xwiki-commons_CVE-2023-36471_14-10-5&#8243;,&#8221;category_name&#8221;:&#8221;Exploit&#8221;,&#8221;post_link&#8221;:&#8221;&#8221;,&#8221;product&#8221;:&#8221;&#8221;,&#8221;version&#8221;:&#8221;&#8221;,&#8221;vendor&#8221;:&#8221;&#8221;,&#8221;ai_description&#8221;:&#8221;&#8221;,&#8221;ai_severity&#8221;:&#8221;&#8221;,&#8221;ai_vendor&#8221;:&#8221;&#8221;,&#8221;ai_product&#8221;:&#8221;&#8221;,&#8221;ai_version&#8221;:&#8221;&#8221;,&#8221;ai_score&#8221;:0}<\/p>\n","protected":false},"excerpt":{"rendered":"<p>{&#8220;lastseen&#8221;:&#8221;2025-08-18T21:27:28&#8243;,&#8221;description&#8221;:&#8221;# XWiki Commons\\n\\n[XWiki Commons](http:\/\/commons.xwiki.org\/xwiki\/bin\/view\/Main\/) are technical libraries common to several other top level XWiki projects. \\n\\nThese libraries can be used by projects outside of the&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,86,12,32,13,7,11,5],"class_list":["post-13381","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-90","tag-exploit","tag-githubexploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525 - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=13381\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525 - zero redgem\" \/>\n<meta property=\"og:description\" content=\"{&#8220;lastseen&#8221;:&#8221;2025-08-18T21:27:28&#8243;,&#8221;description&#8221;:&#8221;# XWiki Commonsnn[XWiki Commons](http:\/\/commons.xwiki.org\/xwiki\/bin\/view\/Main\/) are technical libraries common to several other top level XWiki projects. nnThese libraries can be used by projects outside of the...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=13381\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-08-18T16:52:24+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13381#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13381\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525\",\"datePublished\":\"2025-08-18T16:52:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13381\"},\"wordCount\":444,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CRITICAL\",\"CVE\",\"CVSS\",\"CVSS-9.0\",\"exploit\",\"githubexploit\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=13381#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13381\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13381\",\"name\":\"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525 - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-08-18T16:52:24+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13381#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=13381\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13381#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525 - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=13381","og_locale":"en_US","og_type":"article","og_title":"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525 - zero redgem","og_description":"{&#8220;lastseen&#8221;:&#8221;2025-08-18T21:27:28&#8243;,&#8221;description&#8221;:&#8221;# XWiki Commonsnn[XWiki Commons](http:\/\/commons.xwiki.org\/xwiki\/bin\/view\/Main\/) are technical libraries common to several other top level XWiki projects. nnThese libraries can be used by projects outside of the...","og_url":"https:\/\/zero.redgem.net\/?p=13381","og_site_name":"zero redgem","article_published_time":"2025-08-18T16:52:24+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=13381#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=13381"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525","datePublished":"2025-08-18T16:52:24+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=13381"},"wordCount":444,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CRITICAL","CVE","CVSS","CVSS-9.0","exploit","githubexploit","news","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=13381#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=13381","url":"https:\/\/zero.redgem.net\/?p=13381","name":"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525 - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-08-18T16:52:24+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=13381#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=13381"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=13381#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"Exploit for Cross-site Scripting in Xwiki Commons_6276B3AF-472D-5204-999D-C8E1355D5525"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/13381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13381"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/13381\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}