Skip to content
Xwiki Platform vulnerabilities
-
xwiki xwiki-platform
XWiki Platform: Privilege escalation from edit to script right through Live Data editing
CVE-2026-53966
Fix available
7.1 High
-
xwiki xwiki-platform
XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
CVE-2026-34151
Fix available
8.2 High
-
xwiki xwiki-platform
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
CVE-2026-48048
Fix available
7.5 High
-
xwiki xwiki-platform
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
CVE-2026-48047
Fix available
5.9 Medium
-
xwiki xwiki-platform
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CVE-2026-33137
Fix available
9.3 Critical
-
xwiki, xwiki org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore +2 more
XWiki's REST APIs can list all pages/spaces, leading to unavailability
CVE-2026-40104
Fix available
6.9 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
CVE-2026-40105
Fix available
6.5 Medium
-
xwiki, org.xwiki.platform xwiki-platform-legacy-oldcore, xwiki-platform-oldcore +1 more +3 more
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
CVE-2026-33229
Public exploitFix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform affected by click-jacking through CSS injection in comments
CVE-2026-26000
Fix available
5.3 Medium
-
xwiki, xwiki xwiki-platform, xwiki-rendering +2 more
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
CVE-2026-24128
Fix available
6.5 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
CVE-2025-66473
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
CVE-2025-66472
Fix available
6.5 Medium
-
xwiki, xwiki xwiki-platform +1 more
The XWiki Jetty package (XJetty) allows accessing any application file through URL
CVE-2025-55749
Fix available
8.7 High
-
xwiki xwiki-platform
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
CVE-2025-52472
Fix available
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform's configuration files can be accessed through jsx and sx endpoints
CVE-2025-55748
Fix available
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform's configuration files can be accessed through the webjars API
CVE-2025-55747
Fix available
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
CVE-2025-58049
Fix available
5.8 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform: Password and email exposure in xml.vm fields
CVE-2025-54125
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform: Any user with editing rights can access password properties through Database List Properties
CVE-2025-54124
Fix available
7.1 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform contains Reflected XSS vulnerability in two templates
CVE-2025-32430
Fix available
6.5 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform's searchDocuments API allows for SQL injection
CVE-2025-54385
Fix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
CVE-2025-32429
Public exploitFix available
EPSS 85.5%
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki does not require right warnings for notification displayer objects
CVE-2025-49587
Fix available
6.4 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows remote code execution through preview of XClass changes in AWM editor
CVE-2025-49586
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki does not require right warnings for XClass definitions
CVE-2025-49585
Fix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki makes title of inaccessible pages available through the class property values REST API
CVE-2025-49584
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
CVE-2025-49583
Fix available
5.1 Medium
-
xwiki, xwiki xwiki-platform +1 more
XWiki's required right warnings for macros are incomplete
CVE-2025-49582
Fix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows remote code execution through default value of wiki macro wiki-type parameters
CVE-2025-49581
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows privilege escalation through link refactoring
CVE-2025-49580
Fix available
8.5 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows SQL injection in query endpoint of REST API with Oracle
CVE-2024-56158
Fix available
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right
CVE-2025-48063
Fix available
4.8 Medium
-
xwiki, xwiki xwiki-platform +1 more
Any user with view access to the XWiki space can change the authenticator
CVE-2025-46557
Fix available
8.4 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
CVE-2025-46554
Fix available
5.3 Medium
-
xwiki, xwiki xwiki-platform +1 more
org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
CVE-2025-32974
Fix available
9.1 Critical
-
xwiki, xwiki xwiki-platform +1 more
org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
CVE-2025-32973
Fix available
9.1 Critical
-
xwiki, xwiki xwiki-platform +1 more
The lesscss script service allows cache clearing without programming right
CVE-2025-32972
Fix available
2.7 Low
-
xwiki, xwiki xwiki-platform +1 more
XWiki Solr script service doesn't take dropped programming right into account
CVE-2025-32971
Fix available
3.8 Low
-
xwiki, xwiki xwiki-platform +1 more
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
CVE-2025-32970
Fix available
6.1 Medium
-
xwiki, xwiki xwiki-platform +1 more
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
CVE-2025-32969
Fix available
EPSS 80.0%
9.3 Critical
-
xwiki, xwiki xwiki-platform +1 more
org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
CVE-2025-32968
Fix available
8.6 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki
CVE-2025-32783
4.7 Medium
-
xwiki, xwiki xwiki-platform +1 more
The WikiManager REST API allows any user to create wikis
CVE-2025-29926
Fix available
7.9 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows unregistered users to access private pages information through REST endpoint
CVE-2025-29925
Fix available
8.7 High
-
xwiki, xwiki xwiki-platform +1 more
XWiki uses the wrong wiki reference in AuthorizationManager
CVE-2025-29924
Fix available
8.7 High
-
xwiki platform, xwiki, xwiki xwiki-platform +2 more
Remote code execution as guest via SolrSearchMacros request in xwiki
CVE-2025-24893
In KEVPublic exploitFix available
EPSS 100.0%
9.8 Critical
-
xwiki, xwiki xwiki-platform +1 more
Privilege escalation (PR) through realtime WYSIWYG editing in XWiki
CVE-2025-23025
Fix available
9.1 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows RCE from script right in configurable sections
CVE-2024-55879
Fix available
9.1 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
CVE-2024-55877
Fix available
10.0 Critical
-
xwiki, xwiki xwiki-platform +1 more
XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
CVE-2024-55876
Fix available
5.4 Medium
- Show olderLoading…