A while back I reported some bugs in Atlassian's Confluence.
As everyone *should* have upgraded by now I feel that I can now
release my proof of concept for CONF-21508 and CONF-21819. (note - I
uncovered and reported these bugs at different times).

Issue 1 (CONF-21508): the document macro did not sanitize or parse
content included within it properly.
example:
 {doc:"/><h2> <marquee xxxxx}"Marquee {doc}
or
 {doc:"/> <b ><script>alert(1);</script>0}"ohoh {doc}

Issue 2 (CONF-21819):  the Table of Contents macro did not sanitize
the filename of certain types of attachment link.

Example:
step 1. create a gliffy diagram for a wiki page and call it anything you want.
step 2. go to the 'view page attachments  page' for your wiki page and
from there to the properties page for your gliffy diagram. On the
properties page rename your diagram to something like
orly"/><x>v<script>alert(1);</script>
step 3.  add {attachments:old=true} to the wiki entry.

--
The abuse of greatness is when it disjoins remorse from power.    --
William Shakespeare, "Julius Caesar"