Skip to contentXwiki Xwiki-platform vulnerabilities
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to CSRF privilege escalation/RCE via the create actionCVE-2023-40572Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform privilege escalation (PR) from account through AWM content fieldsCVE-2023-40177Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreSXSS in the user profile via the timezone displayerCVE-2023-40176Fix availableEPSS 80.0%9.1 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR)/RCE from account through Invitation subject/messageCVE-2023-37914Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's obfuscated email addresses should not be sortedCVE-2023-38509Fix available4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiCVE-2023-37462Fix availableEPSS 91.6%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST APICVE-2023-37277Fix available9.7 Critical
- xwiki ckeditor integration, xwiki, xwiki xwiki-platform +2 morePersistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki PlatformCVE-2023-36477Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreUpgrading doesn't prevent exploiting vulnerable XWiki documentsCVE-2023-36468Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection through NotificationRSSService in XWiki PlatformCVE-2023-36469Fix availableEPSS 82.0%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection in icon themes of XWiki PlatformCVE-2023-36470Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication pageCVE-2023-35161Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit templateCVE-2023-35160Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace templateCVE-2023-35159Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore templateCVE-2023-35158Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via delattachment actionCVE-2023-35157Fix available8.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete templateCVE-2023-35156Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR) from account through TipsPanelCVE-2023-35166Fix availableEPSS 63.1%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions templateCVE-2023-35162Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to cross-site scripting in target parameter via share page by emailCVE-2023-35155Fix available8.8 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parametersCVE-2023-35153Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResultsCVE-2023-35152Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform may show email addresses in clear in REST resultsCVE-2023-35151Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationCVE-2023-35150Fix availableEPSS 77.7%9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform may retrieve email addresses of all usersCVE-2023-34467Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's tags on non-viewable pages can be revealed to usersCVE-2023-34466Fix available4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's Mail.MailConfig can be edited by any user with edit rightsCVE-2023-34465Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent templateCVE-2023-34464Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreURL Redirection to Untrusted Site in XWikiCVE-2023-32068Fix availableEPSS 55.6%4.7 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to RXSS via editor parameter - importinline templateCVE-2023-32071Fix availableEPSS 70.4%9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform privilege escalation (PR)/RCE from account through class sheetCVE-2023-32069Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreExposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewerCVE-2023-29517Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreCode injection from view right on XWiki.AttachmentSelector in xwiki-platformCVE-2023-29516Fix availableEPSS 65.9%9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCross-site scripting (XSS) in xwiki-platformCVE-2023-29515Fix available7.7 High
- xwiki, xwiki xwiki-platform +1 moreCode injection in template provider administration in xwiki-platformCVE-2023-29514Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreUsers can be created even when registration is disabled without validation via the template macro in xwiki-platformCVE-2023-29513Fix available5.0 Medium
- xwiki, xwiki xwiki-platform +1 moreCode injection in xwiki-platform-web-templatesCVE-2023-29512Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection via unescaped translations in xwiki-platformCVE-2023-29510Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from view right on XWiki.ClassSheet in xwiki-platformCVE-2023-29522Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from account/view through VFS Tree macro in xwiki-platformCVE-2023-29521Fix available8.4 High
- xwiki, xwiki xwiki-platform +1 morePage render failure due to broken translations in xwiki-platformCVE-2023-29520Fix available4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreCode injection in org.xwiki.platform:xwiki-platform-attachment-uiCVE-2023-29519Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from view right using Invitation.InvitationCommon in xwiki-platformCVE-2023-29518Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection in display method used in user profiles in xwiki-platformCVE-2023-29523Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from account through XWiki.SchedulerJobSheet in xwiki-platformCVE-2023-29524Fix availableEPSS 75.7%10.0 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platformCVE-2023-29525Fix availableEPSS 77.8%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreAsync and display macro allow displaying and interacting with any document in restricted modeCVE-2023-29526Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from account through AWM view sheet in xwiki platformCVE-2023-29527Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroCVE-2023-29207Fix available8.9 High
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can have information about hidden users on subwikis through uorgsuggest.vmCVE-2023-29203Fix available3.7 Low
- Show moreLoading…