Skip to contentXwiki Platform vulnerabilities
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform has an SQL injection in getdocuments.vm with sort parameterCVE-2024-55663Fix available8.6 High
- xwiki, xwiki xwiki-platform +1 moreXWiki allows remote code execution through the extension sheetCVE-2024-55662Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreData leak of notification filters of users in XWiki PlatformCVE-2024-46979Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreMissing checks for notification filter preferences editions in XWiki PlatformCVE-2024-46978Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform document history including authors of any page exposed to unauthorized actorsCVE-2024-45591Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform allows XSS through XClass name in string propertiesCVE-2024-43400Public exploitFix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themCVE-2024-43401Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS through conflict resolutionCVE-2024-41947Public exploitFix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheetCVE-2024-37901Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploaderCVE-2024-37900Fix availableEPSS 15.8%6.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to document deletion and overwrite from editCVE-2024-37898Fix available4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki programming rights may be inherited by inclusionCVE-2024-38369Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreDisabling a user account changes its author, allowing RCE from user account in XWikiCVE-2024-37899Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution from account through UIExtension parametersCVE-2024-31997Fix availableEPSS 73.9%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF remote code execution through the realtime HTML Converter APICVE-2024-31988Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution from account via custom skins supportCVE-2024-31987Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF remote code execution through scheduler job's document referenceCVE-2024-31986Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF in the job schedulerCVE-2024-31985Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution through space title and Solr space facetCVE-2024-31984Fix availableEPSS 83.0%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution from edit in multilingual wikis via translationsCVE-2024-31983Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution as guest via DatabaseSearchCVE-2024-31982Public exploitFix availableEPSS 34.5%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Privilege escalation (PR) from user registration through PDFClassCVE-2024-31981Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution from account via SearchSuggestSourceSheetCVE-2024-31465Fix availableEPSS 75.6%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Password hash might be leaked by diff once the xobject holding them is deletedCVE-2024-31464Fix available6.8 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Denial of Service attack through attachmentsCVE-2024-21651Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki has no right protection on rollback actionCVE-2024-21648Fix available8.0 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Remote Code Execution vulnerability via user registrationCVE-2024-21650Fix availableEPSS 93.5%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreVelocity execution without script right through tree macroCVE-2023-50732Fix available8.3 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution/programming rights with configuration section from any user accountCVE-2023-50723Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClassCVE-2023-50722Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform RCE from account through SearchAdminCVE-2023-50721Fix availableEPSS 78.8%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses password hashes of all usersCVE-2023-50719Fix availableEPSS 83.5%7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses email addresses of usersCVE-2023-50720Fix availableEPSS 59.1%5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest serviceCVE-2023-48241Fix availableEPSS 72.8%7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgeryCVE-2023-48240Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreCode execution via the edit action in XWiki platformCVE-2023-46243Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection in XWiki PlatformCVE-2023-46242Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation in Xwiki platformCVE-2023-46244Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreRemote code execution through the section parameter in Administration as guest in XWiki PlatformCVE-2023-46731Fix availableEPSS 89.7%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreReflected Cross-site scripting through revision parameter in content menu in XWiki PlatformCVE-2023-46732Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS with edit right in the create document form for existing pagesCVE-2023-45137Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabledCVE-2023-45136Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki users can be tricked to execute scripts as the create page action doesn't display the page's titleCVE-2023-45135Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS vulnerability from account in the create page form via template providerCVE-2023-45134Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converterCVE-2023-37913Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documentsCVE-2023-37911Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment MoveCVE-2023-37910Fix available8.1 High
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheetCVE-2023-37909Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreVelocity execution without script rights in Xwiki platformCVE-2023-41046Fix available6.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's Groovy jobs check the wrong author, allowing remote code executionCVE-2023-40573Fix available9.1 Critical
- Show moreLoading…