Skip to contentXwiki Platform vulnerabilities
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Old Core vulnerable to Authentication Bypass Using the Login ActionCVE-2022-36092Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized ActorCVE-2022-36091Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive usersCVE-2022-36090Fix available8.1 High
- xwiki, xwiki xwiki-platform +1 moreXWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groupsCVE-2022-31166Fix available8.1 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same referenceCVE-2022-31167Fix available7.1 High
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in Filter Stream Converter Application in XWiki PlatformCVE-2022-29258Fix available7.4 High
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in the Flamingo theme managerCVE-2022-29251Fix available7.4 High
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in XWiki Platform Wiki UI Main WikiCVE-2022-29252Fix available7.4 High
- xwiki, xwiki xwiki-platform +1 morePath Traversal in XWiki PlatformCVE-2022-29253Fix available2.7 Low
- xwiki, xwiki xwiki-platform +1 moreCrypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformCVE-2022-29161Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can list hidden document from multiple velocity templatesCVE-2022-24820Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can retrieve the list of users through uorgsuggest.vmCVE-2022-24819Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreIncorrect Use of Privileged APIs in org.xwiki.platform.skin.skinxCVE-2022-24821Fix available6.8 Medium
- xwiki, xwiki xwiki-platform +1 moreCross site scripting in registration template in xwiki-platformCVE-2022-23622Fix available7.4 High
- xwiki, xwiki xwiki-platform +1 moreMissing authorization in xwiki-platformCVE-2022-23621Fix available5.5 Medium
- xwiki, xwiki xwiki-platform +1 morePath traversal in xwiki-platform-skin-skinxCVE-2022-23620Fix available6.8 Medium
- xwiki, xwiki xwiki-platform +1 moreInformation exposure in xwiki-platformCVE-2022-23619Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreOpen Redirect in xwiki-platformCVE-2022-23618Fix available4.7 Medium
- xwiki, xwiki xwiki-platform +1 moreMissing authorization in xwiki-platformCVE-2022-23617Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreRemote code execution in xwiki-platformCVE-2022-23616Fix available8.8 High
- xwiki, xwiki xwiki-platform +1 morePartial authorization bypass on document save in xwiki-platformCVE-2022-23615Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXSS by SVG upload in xwiki-platformCVE-2021-43841Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreCross-Site Request Forgery in xwiki-platformCVE-2021-32732Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreThe reset password form reveal users email addressCVE-2021-32731Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreNo CSRF protection on the password change formCVE-2021-32730Fix available5.7 Medium
- xwiki, xwiki xwiki-platform +1 moreA user without PR can reset user authentication failures informationCVE-2021-32729Fix available2.0 Low
- xwiki, xwiki xwiki-platform +1 moreUsers registered with email verification can self re-activate their disabled accountsCVE-2021-32620Fix available8.8 High
- xwiki, xwiki xwiki-platform +1 moreScript injection without script or programming rights through Gadget titlesCVE-2021-32621Fix available8.8 High
- xwiki, xwiki xwiki-platform +1 moreXSS Cross Site ScriptingCVE-2021-29459Fix available9.6 Critical
- xwiki, xwiki xwiki-platform +1 moreRating Script Service expose XWiki to SQL injectionCVE-2021-21380Public exploitFix available7.7 High
- xwiki, xwiki xwiki-platform +1 moreIt's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macroCVE-2021-21379Fix available7.7 High
- xwiki, xwiki xwiki-platform +1 moreRCE in XWikiCVE-2020-15252Fix available8.5 High
- xwiki, xwiki xwiki-platform +1 moreUsers with SCRIPT rights can execute arbitrary code in XWikiCVE-2020-15171Fix available6.6 Medium
- xwiki, xwiki platform +1 moreCode Injection in XWiki PlatformCVE-2020-110579.9 Critical