CVE-2023-37465Medium· 6.5▾ Sunlitorg.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
It's possible to forge a request to delete a message.
The problem has been patched in version 2.0-rc-1 of Discussion Extension.
There's no easy workaround except upgrading.
https://jira.xwiki.org/browse/DISCUSSION-22
If you have any questions or comments about this advisory:
org.xwiki.contrib:discussions-server < 2.0-rc-1Upgrade to a patched release:
org.xwiki.contrib:discussions-server 2.0-rc-1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14117Medium· 4.3A vulnerability has been found in fit2cloud Halo 2.21.10
CVE-2025-15405Medium· 4.3A vulnerability was detected in PHPEMS up to 11.0
CVE-2025-11051Medium· 4.3A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0
CVE-2025-11029Medium· 4.3A weakness has been identified in givanz Vvveb up to 1.0.7.2
CVE-2025-12202Medium· 4.3A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1
CVE-2025-53837Critical· 9.9XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc)