CVE-2022-29251

XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeName" form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `FlamingoThemesCode.WebHomeSheet` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.

• CWE-80
• CWE-116
• CWE-79

• https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vmhh-xh3g-j992Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19294Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vmhh-xh3g-j992Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19294Vendor Advisory

Published

May 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29246Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-29247Electron is a framework for writing cross-platform desktop a…9.8
• CVE-2022-29248Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 …8.1
• CVE-2022-29249JavaEZ is a library that adds new functions to make Java eas…7.5
• CVE-2022-2925Cross-site Scripting (XSS) - Stored in GitHub repository app…5.4
• CVE-2022-29250GLPI is a Free Asset and IT Management Software package, tha…6.5
• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1
• CVE-2022-29253XWiki Platform is a generic wiki platform offering runtime s…2.7
• CVE-2022-29254silverstripe-omnipay is a SilverStripe integration with Omni…6.5
• CVE-2022-29255Vyper is a Pythonic Smart Contract Language for the ethereum…7.5
• CVE-2022-29256sharp is an application for Node.js image processing. Prior …6.7
• CVE-2022-29257Electron is a framework for writing cross-platform desktop a…7.2