CVE-2024-52300

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.

• CWE-80
• CWE-79

• https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6gThird Party Advisory

Published

Nov 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52295DataEase is an open source data visualization analysis tool.…9.8
• CVE-2024-52296libosdp is an implementation of IEC 60839-11-5 OSDP (Open Su…6.5
• CVE-2024-52297Tolgee is an open-source localization platform. Tolgee 3.81.…7.5
• CVE-2024-52298macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozill…7.5
• CVE-2024-52299macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozill…7.5
• CVE-2024-5230A vulnerability has been found in EnvaySoft FleetCart up to …6.9
• CVE-2024-52301Laravel is a web application framework. When the register_ar…7.5
• CVE-2024-52302common-user-management is a robust Spring Boot application f…8.7
• CVE-2024-52303aiohttp is an asynchronous HTTP client/server framework for …8.7
• CVE-2024-52304aiohttp is an asynchronous HTTP client/server framework for …7.5
• CVE-2024-52305UnoPim is an open-source Product Information Management (PIM…4.8
• CVE-2024-52306FileManager provides a Backpack admin interface for files an…9.8