Skip to contentXwiki Platform vulnerabilities
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX pluginsCVE-2023-29206Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macroCVE-2023-29205Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreURL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcoreCVE-2023-29204Fix available4.7 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityCVE-2023-29202Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 morexwiki-platform-administration-ui vulnerable to privilege escalationCVE-2023-29511Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalationCVE-2023-30537Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityCVE-2023-29509Fix availableEPSS 76.2%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site ScriptingCVE-2023-29508Fix available8.9 High
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthorsCVE-2023-29507Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpointsCVE-2023-29506Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityCVE-2023-29214Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-logging-ui Injection vulnerabilityCVE-2023-29213Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 morexwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityCVE-2023-29212Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerabilityCVE-2023-29211Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerabilityCVE-2023-29210Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerabilityCVE-2023-29209Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreData leak through deleted documentsCVE-2023-29208Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreData leak through a XAR import XXE attack in xwiki-platform-xar-modelCVE-2023-27480Fix available7.7 High
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-uiCVE-2023-27479Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform allows macro execution as any user without programming rights through the context macroCVE-2023-26056Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreIn XWiki Platform, saving a document with a large object number leads to persistent OOM errorsCVE-2023-26470Fix available5.7 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform users may execute anything with superadmin right through comments and async macroCVE-2023-26471Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profileCVE-2023-26472Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vmCVE-2023-26473Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorCVE-2023-26474Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreTwo XWiki Platform UIs Expose Sensitive Information to an Unauthorized ActorCVE-2023-26476Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityCVE-2023-26477Fix availableEPSS 74.8%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or FunctionCVE-2023-26478Fix available6.6 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional ConditionsCVE-2023-26479Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live DataCVE-2023-26480Fix available8.9 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Remote Code Execution in AnnotationsCVE-2023-26475Fix availableEPSS 63.6%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreMissing Authorization in XWiki PlatformCVE-2022-41937Fix available9.6 Critical
- xwiki, xwiki xwiki-platform +1 moreExposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-serverCVE-2022-41936Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreExposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-uiCVE-2022-41935Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-uiCVE-2022-41934Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 morePlaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-defaultCVE-2022-41933Fix available6.2 Medium
- xwiki, xwiki xwiki-platform +1 moreCreation of new database tables through login form on PostgreSQLCVE-2022-41932Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-uiCVE-2022-41931Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable usersCVE-2022-41930Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreMissing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcoreCVE-2022-41929Fix available4.9 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xmlCVE-2022-41928Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tagsCVE-2022-41927Fix available7.4 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval InjectionCVE-2022-36100Fix availableEPSS 73.6%9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Mentions UI vulnerable to Cross-site ScriptingCVE-2022-36098Fix availableEPSS 71.6%8.9 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityCVE-2022-36099Fix availableEPSS 76.3%9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formCVE-2022-36097Fix availableEPSS 58.2%8.9 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listCVE-2022-36096Fix availableEPSS 60.2%8.9 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Cross-Site Request Forgery (CSRF) for actions on tagsCVE-2022-36095Fix available4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Web Parent POM vulnerable to XSS in the attachment historyCVE-2022-36094Fix availableEPSS 64.8%8.9 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution WizardCVE-2022-36093Fix available8.5 High
- Show moreLoading…