Apache Jspwiki
Apache · 24 CVEs
Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
Jul 30, 2026
Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
Jul 30, 2026
Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
Jul 30, 2026
Apache JSPWiki: UserManager does not sanity-check user database at startup
Jul 30, 2026
Apache JSPWiki: Error Handling - Reveals Error Details
Jul 30, 2026
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin
Jul 31, 2025
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
Jul 31, 2025
Apache JSPWiki: Cross-site scripting vulnerability on upload page
Jun 24, 2024
Apache JSPWiki: XSS Injection points in several plugins
May 25, 2023
User Group Privilege Escalation
Aug 4, 2022
Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin
Aug 4, 2022
Apache JSPWiki CSRF in UserPreferences.jsp
Aug 4, 2022
Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
Aug 4, 2022
XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2
Aug 4, 2022
Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen
Feb 25, 2022
Apache JSPWiki CSRF Account Takeover
Feb 25, 2022
Arbitrary file deletion on logout
Nov 24, 2021
XSS vulnerability on Denounce plugin
Nov 24, 2021
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, whi…
May 20, 2019
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could…
May 20, 2019
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which…
May 20, 2019
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9…
Mar 28, 2019
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No in…
Mar 28, 2019
A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could l…
Feb 11, 2019
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-48910 | Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing | MEDIUM | 0.56% | Jul 30, 2026 |
| CVE-2026-28814 | Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering | HIGH | 0.66% | Jul 30, 2026 |
| CVE-2026-28813 | Apache JSPWiki: JSPWiki vulnerable to JSON hijacking | HIGH | 0.27% | Jul 30, 2026 |
| CVE-2026-28812 | Apache JSPWiki: UserManager does not sanity-check user database at startup | CRITICAL | 0.69% | Jul 30, 2026 |
| CVE-2026-28811 | Apache JSPWiki: Error Handling - Reveals Error Details | HIGH | 0.79% | Jul 30, 2026 |
| CVE-2025-24854 | Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin | MEDIUM | 0.45% | Jul 31, 2025 |
| CVE-2025-24853 | Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing | MEDIUM | 0.53% | Jul 31, 2025 |
| CVE-2024-27136 | Apache JSPWiki: Cross-site scripting vulnerability on upload page | MEDIUM | 60.85% | Jun 24, 2024 |
| CVE-2022-46907 | Apache JSPWiki: XSS Injection points in several plugins | MEDIUM | 1.16% | May 25, 2023 |
| CVE-2022-34158 | User Group Privilege Escalation | HIGH | 1.24% | Aug 4, 2022 |
| CVE-2022-28732 | Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin | MEDIUM | 82.39% | Aug 4, 2022 |
| CVE-2022-28731 | Apache JSPWiki CSRF in UserPreferences.jsp | MEDIUM | 57.78% | Aug 4, 2022 |
| CVE-2022-28730 | Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp | MEDIUM | 85.75% | Aug 4, 2022 |
| CVE-2022-27166 | XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 | MEDIUM | 85.75% | Aug 4, 2022 |
| CVE-2022-24948 | Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen | MEDIUM | 2.25% | Feb 25, 2022 |
| CVE-2022-24947 | Apache JSPWiki CSRF Account Takeover | HIGH | 1.16% | Feb 25, 2022 |
| CVE-2021-44140 | Arbitrary file deletion on logout | CRITICAL | 6.36% | Nov 24, 2021 |
| CVE-2021-40369 | XSS vulnerability on Denounce plugin | MEDIUM | 3.42% | Nov 24, 2021 |
| CVE-2019-10078 | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Init… | MEDIUM | 4.94% | May 20, 2019 |
| CVE-2019-10077 | A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. | MEDIUM | 4.68% | May 20, 2019 |
| CVE-2019-10076 | A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. | MEDIUM | 4.72% | May 20, 2019 |
| CVE-2019-0225 | A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by… | HIGH | 9.99% | Mar 28, 2019 |
| CVE-2019-0224 | In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server o… | MEDIUM | 5.15% | Mar 28, 2019 |
| CVE-2018-20242 | A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking. | MEDIUM | 5.36% | Feb 11, 2019 |
Showing 1 to 24 of 24 CVEs