CVE-2006-7223

no score yetEPSS 1.5%

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2007-09-14
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

xwiki:xwiki

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-h5jm-jjgx-q2wf	Maven	org.xwiki.platform:xwiki-platform-oldcore	>=0.9.543 <1.0B1	1.0B1

References

http://jira.xwiki.org/jira/browse/XWIKI-366
http://jira.xwiki.org/jira/browse/XWIKI-366

Check your stack JSON