Skip to content
Xwiki vulnerabilities
Newest
-
xwiki xwiki-rendering
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
CVE-2025-53837
Fix available
9.9 Critical
-
xwiki xwiki-platform
XWiki Platform: Privilege escalation from edit to script right through Live Data editing
CVE-2026-53966
Fix available
7.1 High
-
xwiki xwiki-platform
XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
CVE-2026-34151
Fix available
8.2 High
-
xwiki xwiki-platform
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
CVE-2026-48048
Fix available
7.5 High
-
xwiki xwiki-platform
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
CVE-2026-48047
Fix available
5.9 Medium
-
xwiki xwiki-platform
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CVE-2026-33137
Fix available
9.3 Critical
-
xwiki xwiki-commons
XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
CVE-2026-23734
Fix available
EPSS 18.5%
9.3 Critical
-
cryptpad
CryptPad unbounded WebSocket frame flood
CVE-2025-51846
Public exploit
8.7 High
-
xwiki, xwiki org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore +2 more
XWiki's REST APIs can list all pages/spaces, leading to unavailability
CVE-2026-40104
Fix available
6.9 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
CVE-2026-40105
Fix available
6.5 Medium
-
xwiki, org.xwiki.platform xwiki-platform-legacy-oldcore, xwiki-platform-oldcore +1 more +3 more
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
CVE-2026-33229
Public exploitFix available
8.6 High
-
xwiki blog application, xwiki-contrib application-blog-ui +1 more
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
CVE-2025-66024
Public exploitFix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform affected by click-jacking through CSS injection in comments
CVE-2026-26000
Fix available
5.3 Medium
-
xwiki, xwiki xwiki-platform, xwiki-rendering +2 more
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
CVE-2026-24128
Fix available
6.5 Medium
-
xwiki full calendar macro, xwiki-contrib macro-fullcalendar +1 more
XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
CVE-2025-65091
Fix available
10.0 Critical
-
xwiki full calendar macro, xwiki-contrib macro-fullcalendar +1 more
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
CVE-2025-65090
Fix available
5.3 Medium
-
xwiki xwiki-rendering
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
CVE-2025-66474
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
CVE-2025-66473
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
CVE-2025-66472
Fix available
6.5 Medium
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro
CVE-2025-65036
8.3 High
-
xwiki, xwiki xwiki-platform +1 more
The XWiki Jetty package (XJetty) allows accessing any application file through URL
CVE-2025-55749
Fix available
8.7 High
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki view file macro: User can view content of office file without view rights on the attachment
CVE-2025-65089
Fix available
6.8 Medium
-
xwiki xwiki-platform
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
CVE-2025-52472
Fix available
9.3 Critical
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki Remote Macros vulnerable to remote code execution using the panel macro
CVE-2025-55728
10.0 Critical
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro
CVE-2025-55727
10.0 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform's configuration files can be accessed through jsx and sx endpoints
CVE-2025-55748
Fix available
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform's configuration files can be accessed through the webjars API
CVE-2025-55747
Fix available
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
CVE-2025-58049
Fix available
5.8 Medium
-
xwiki
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the...
CVE-2025-51991
8.8 High
-
xwiki
XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS)...
CVE-2025-51990
4.8 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform: Password and email exposure in xml.vm fields
CVE-2025-54125
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform: Any user with editing rights can access password properties through Database List Properties
CVE-2025-54124
Fix available
7.1 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform contains Reflected XSS vulnerability in two templates
CVE-2025-32430
Fix available
6.5 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform's searchDocuments API allows for SQL injection
CVE-2025-54385
Fix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
CVE-2025-32429
Public exploitFix available
EPSS 85.5%
9.3 Critical
-
xwiki, xwiki xwiki-rendering +1 more
XWiki Rendering is vulnerable to RCE attacks when processing nested macros
CVE-2025-53836
Fix available
10.0 Critical
-
xwiki, xwiki xwiki-rendering +1 more
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
CVE-2025-53835
Fix available
9.1 Critical
-
cryptpad
CryptPad 2FA Bypass Vulnerability
CVE-2025-49591
7.4 High
-
cryptpad
CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
CVE-2025-49590
2.9 Low
-
xwiki, xwiki xwiki-platform +1 more
XWiki does not require right warnings for notification displayer objects
CVE-2025-49587
Fix available
6.4 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows remote code execution through preview of XClass changes in AWM editor
CVE-2025-49586
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki does not require right warnings for XClass definitions
CVE-2025-49585
Fix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki makes title of inaccessible pages available through the class property values REST API
CVE-2025-49584
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
CVE-2025-49583
Fix available
5.1 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki's required right warnings for macros are incomplete
CVE-2025-49582
Fix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows remote code execution through default value of wiki macro wiki-type parameters
CVE-2025-49581
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows privilege escalation through link refactoring
CVE-2025-49580
Fix available
8.5 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows SQL injection in query endpoint of REST API with Oracle
CVE-2024-56158
Fix available
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right
CVE-2025-48063
Fix available
4.8 Medium
-
xwiki, xwiki-contrib syntax-markdown +1 more
org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content
CVE-2025-46558
Fix available
9.1 Critical
- Show olderLoading…