Xwiki — PoC Archivehttps://poc.intelseclab.com/tags/xwiki/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000XWiki SolrSearch Macro Unauthenticated Groovy RCE (CVE-2025-24893)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Critical severity (CVSS 9.8) — web · CVE-2025-24893. Status: Weaponized. Affects: XWiki (SolrSearch macro, Main.SolrSearch). Tags: xwiki, groovy, rce, unauthenticated, cwe-94, code-injection, reverse-shell, python, wiki.webCriticalxwikigroovyrceunauthenticatedcwe-94code-injectionreverse-shellpythonwikiXWiki Unauthenticated XAR Import Leading to RCE — CVE-2026-33137https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33137-xwiki-xar-import-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33137-xwiki-xar-import-rce/Critical severity (CVSS 9.3) — web · CVE-2026-33137. Status: Weaponized. Affects: XWiki Platform. Tags: xwiki, rce, missing-authorization, xar-import, groovy, velocity, unauthenticated, cwe-862.webCriticalxwikircemissing-authorizationxar-importgroovyvelocityunauthenticatedcwe-862