Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. org.xwiki.platform:xwiki-platform-web starting in version 3.1-milestone-1 and prior to 13.4-rc-1, org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.2 and 15.5-rc-1, and org.xwiki.platform:xwiki-web-standard starting in version 2.4-milestone-2 and prior to version 3.1-milestone-1 is vulnerable to cross-site scripting. An attacker can create a template provider on any document that is part of the wiki (could be the attacker's user …