# org.apache.jspwiki:jspwiki-main (Maven) vulnerabilities

18 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.jspwiki/jspwiki-main

## Advisories (18)

### [CVE-2025-24854](https://cve.now/CVE-2025-24854): Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin

- Severity: Medium 6.1
- Published: Jul 31, 2025
- Affected: fixed in 2.12.3.

### [CVE-2025-24853](https://cve.now/CVE-2025-24853): Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing

- Severity: High 7.5
- Published: Jul 31, 2025
- Affected: fixed in 2.12.3.

### [CVE-2024-27136](https://cve.now/CVE-2024-27136): Apache JSPWiki: Cross-site scripting vulnerability on upload page

- Severity: Medium 6.1
- Published: Jun 24, 2024
- Affected: fixed in 2.12.2.

### [CVE-2022-46907](https://cve.now/CVE-2022-46907): Apache JSPWiki: XSS Injection points in several plugins

- Severity: Medium
- Published: May 25, 2023
- Affected: fixed in 2.12.0.

### [CVE-2022-34158](https://cve.now/CVE-2022-34158): User Group Privilege Escalation

- Severity: Unrated
- Published: Aug 4, 2022
- Affected: fixed in 2.11.3.

### [CVE-2022-28732](https://cve.now/CVE-2022-28732): Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin

- Severity: Unrated
- Published: Aug 4, 2022
- Affected: fixed in 2.11.3.

### [CVE-2022-28731](https://cve.now/CVE-2022-28731): Apache JSPWiki CSRF in UserPreferences.jsp

- Severity: Unrated
- Published: Aug 4, 2022
- Affected: fixed in 2.11.3.

### [CVE-2022-28730](https://cve.now/CVE-2022-28730): Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

- Severity: Unrated
- Published: Aug 4, 2022
- Affected: fixed in 2.11.3.

### [CVE-2022-27166](https://cve.now/CVE-2022-27166): XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2

- Severity: Unrated
- Published: Aug 4, 2022
- Affected: fixed in 2.11.3.

### [CVE-2022-24948](https://cve.now/CVE-2022-24948): Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen

- Severity: Unrated
- Published: Feb 25, 2022
- Affected: fixed in 2.11.2.

### [CVE-2022-24947](https://cve.now/CVE-2022-24947): Apache JSPWiki CSRF Account Takeover

- Severity: Unrated
- Published: Feb 25, 2022
- Affected: fixed in 2.11.2.

### [CVE-2021-44140](https://cve.now/CVE-2021-44140): Arbitrary file deletion on logout

- Severity: Unrated
- Published: Nov 24, 2021
- Affected: fixed in 2.11.0.

### [CVE-2021-40369](https://cve.now/CVE-2021-40369): XSS vulnerability on Denounce plugin

- Severity: Unrated
- Published: Nov 24, 2021
- Affected: fixed in 2.11.0.

### [CVE-2019-12407](https://cve.now/CVE-2019-12407): On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache…

- Severity: Unrated
- Published: Sep 23, 2019
- Affected: fixed in 2.11.0.M5.

### [CVE-2019-10078](https://cve.now/CVE-2019-10078): A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to…

- Severity: Unrated
- Published: May 20, 2019
- Affected: from 2.9.0, fixed in 2.11.0.M4.

### [CVE-2019-10077](https://cve.now/CVE-2019-10077): A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session…

- Severity: Unrated
- Published: May 20, 2019
- Affected: from 2.9.0, fixed in 2.11.0.M4.

### [CVE-2019-10076](https://cve.now/CVE-2019-10076): A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to…

- Severity: Unrated
- Published: May 20, 2019
- Affected: from 2.9.0, fixed in 2.11.0.M4.

### [CVE-2019-0224](https://cve.now/CVE-2019-0224): In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session.

- Severity: Unrated
- Published: Mar 28, 2019
- Affected: from 2.9.0, fixed in 2.11.0.M3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.jspwiki:jspwiki-main
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.