CVE-2026-24128 PoC — XWiki Platform 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24128.yaml

Associated Vulnerability

Title:XWiki Platform 安全漏洞 (CVE-2026-24128)
Description:XWiki Platform是XWiki开源的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 7.0-milestone-2至16.10.11版本、17.0.0-rc-1至17.4.4版本和17.5.0-rc-1至17.7.0版本存在安全漏洞，该漏洞源于反射型跨站脚本，可能导致攻击者执行任意操作。

Description

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting (XSS) due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in the context of the victim's browser, potentially leading to session hijacking or other attacks.

File Snapshot


 id: CVE-2026-24128

info:
  name: XWiki Platform Distribution Flavor Main - Cross-Site Scripting
  a

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!