CVE-2025-65036

HIGH

8.3

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-12-05

Last Modified2026-06-17

Data SourcesNVD

Vulnerability Description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

Affected Platforms (CPE)

📦

Xwiki

Pro Macros

< 1.27.1

References & Advisories

🔗 https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-472x-fwh9-r82f

Related Vulnerabilities

CVE-2026-9830

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, lea...

CVE-2026-159628.8

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, ...

CVE-2026-645297.8

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The ...

CVE-2026-64497

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-ex...