CVE-2024-43400
XWiki Platform allows XSS through XClass name in string properties
- Published
- Aug 19, 2024
- Updated
- Aug 22, 2024
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HLow · next 30 days
- Percentile
- 40.7%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.
Sources
- CVE-2024-43400Exploit
Exploit implementation for CVE-2024-43400, enabling automated vulnerability verification and penetration testing against affected systems.
- yasa-cve-2024-43400-main1Exploit
yasa
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.