CVE detail
CVE-2026-48048
XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 3
- within the 30d window
- Peak daily
- 3
- highest bucket
Evidence
Source links by recency
3 source links · newest first
- https://jira.xwiki.org/browse/XWIKI-23875jira.xwiki.org
No excerpt available.
Exploitjira.xwiki.orgAug 10, 2026, 4:19 PM No excerpt available.
Exploitgithub.comAug 10, 2026, 4:19 PMNo excerpt available.
Exploitgithub.comAug 10, 2026, 4:19 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-24078CVSS 6.5 · Medium
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
- CVE-2026-55496CVSS 4.3 · Medium
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes m…
- CVE-2026-56171CVSS 7.1 · High
Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.
- CVE-2026-50657CVSS 4.7 · Medium
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
- CVE-2026-62328CVSS 8.7 · High
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to un…
- CVE-2026-58297CVSS 7.1 · High
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.