Skip to contentXwiki Xwiki-commons vulnerabilities
- xwiki xwiki-commonsXWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashCVE-2026-23734Fix availableEPSS 18.5%9.3 Critical
- xwiki commons, xwiki, xwiki xwiki-commons +2 moreXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionCVE-2024-31996Fix available10.0 Critical
- xwiki commons, xwiki-commons +1 moreHTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xmlCVE-2023-36471Public exploitFix available9.1 Critical
- xwiki, xwiki xwiki-commons +1 moreImproper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xmlCVE-2023-31126Public exploitFix available9.1 Critical
- xwiki commons, xwiki-commons +1 moreCross-site Scripting in org.xwiki.commons:xwiki-commons-xmlCVE-2023-29528Public exploitFix available9.1 Critical
- xwiki, xwiki xwiki-commons +1 moreorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityCVE-2023-29201Public exploitFix available9.1 Critical
- xwiki commons, xwiki-commons +1 moreXWiki Commons may allow privilege escalation to programming rights via user's first nameCVE-2023-26055Fix available10.0 Critical
- xwiki, xwiki xwiki-commons +1 moreArbitrary filesystem write access from VelocityCVE-2022-24897Public exploitFix available7.5 High
- xwiki commons, xwiki-commons +1 moreArbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xmlCVE-2022-24898Fix available4.9 Medium