https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 09:55:27 +0000 https://vulnerability.circl.lu/vuln/bdu:2025-13435 bdu:2025-13435 https://vulnerability.circl.lu/vuln/bdu:2025-13435 https://vulnerability.circl.lu/vuln/cve-2025-32971 <p><strong>Affected:</strong> xwiki-platform</p> <p>XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn&#39;t take dropped programming rights into account. The Solr script service that is accessible in XWiki&#39;s scripting API normally requires programming rights to be called. Due to using the wrong API for checking rights, it doesn&#39;t take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script rights to either cause a high load by indexing documents or to temporarily remove documents from the search index. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0-rc-1.</p> <p><strong>Affected:</strong> xwiki-platform</p> <p>XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn&#39;t take dropped programming rights into account. The Solr script service that is accessible in XWiki&#39;s scripting API normally requires programming rights to be called. Due to using the wrong API for checking rights, it doesn&#39;t take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script rights to either cause a high load by indexing documents or to temporarily remove documents from the search index. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0-rc-1.</p> https://vulnerability.circl.lu/vuln/cve-2025-32971