📦

confluence

Vendor: atlassian

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 5 Code Available
Total RCEs 0 Remote Access
Total CVEs 95 Total Indexed
Avg. EPSS 5.03% Exploit Prob.
Latest CVE CVE-2025-13523 Feb 06

Security Vulnerability Index

Page 3 / 10
4.7 CVSS
CVE-2018-13389

The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml.

EPSS: 1.00%
6.1 CVSS
CVE-2017-18086

Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuesURL parameter.

EPSS: 0.81%
6.1 CVSS
CVE-2017-18085

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the key parameter.

EPSS: 0.81%
4.8 CVSS
CVE-2017-18084

The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the description of a macro.

EPSS: 0.60%
5.4 CVSS
CVE-2017-18083

The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of an uploaded file.

EPSS: 0.58%
6.1 CVSS
CVE-2017-16856

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.

EPSS: 0.81%
4.3 CVSS
CVE-2017-9505

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.

EPSS: 1.26%
5.4 CVSS
CVE-2016-4317

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.

EPSS: 0.71%
6.1 CVSS
CVE-2016-6283
Exploit Found

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileName parameter to pages/doeditattachment.action.

EPSS: 3.17%
4.3 CVSS
CVE-2015-8399
Exploit Found

Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.

EPSS: 60.24%