Skip to contentXwiki vulnerabilities
Newest
- xwiki, xwiki xwiki-platform +1 moreCrypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformCVE-2022-29161Fix available5.4 Medium
- xwiki, xwiki xwiki-commons +1 moreArbitrary filesystem write access from VelocityCVE-2022-24897Public exploitFix available7.5 High
- xwiki commons, xwiki-commons +1 moreArbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xmlCVE-2022-24898Fix available4.9 Medium
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can list hidden document from multiple velocity templatesCVE-2022-24820Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can retrieve the list of users through uorgsuggest.vmCVE-2022-24819Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreIncorrect Use of Privileged APIs in org.xwiki.platform.skin.skinxCVE-2022-24821Fix available6.8 Medium
- xwiki, xwiki xwiki-platform +1 moreCross site scripting in registration template in xwiki-platformCVE-2022-23622Fix available7.4 High
- xwiki, xwiki xwiki-platform +1 moreMissing authorization in xwiki-platformCVE-2022-23621Fix available5.5 Medium
- xwiki, xwiki xwiki-platform +1 morePath traversal in xwiki-platform-skin-skinxCVE-2022-23620Fix available6.8 Medium
- xwiki, xwiki xwiki-platform +1 moreInformation exposure in xwiki-platformCVE-2022-23619Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreOpen Redirect in xwiki-platformCVE-2022-23618Fix available4.7 Medium
- xwiki, xwiki xwiki-platform +1 moreMissing authorization in xwiki-platformCVE-2022-23617Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreRemote code execution in xwiki-platformCVE-2022-23616Fix available8.8 High
- xwiki, xwiki xwiki-platform +1 morePartial authorization bypass on document save in xwiki-platformCVE-2022-23615Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXSS by SVG upload in xwiki-platformCVE-2021-43841Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreCross-Site Request Forgery in xwiki-platformCVE-2021-32732Fix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreThe reset password form reveal users email addressCVE-2021-32731Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreNo CSRF protection on the password change formCVE-2021-32730Fix available5.7 Medium
- xwiki, xwiki xwiki-platform +1 moreA user without PR can reset user authentication failures informationCVE-2021-32729Fix available2.0 Low
- xwiki, xwiki xwiki-platform +1 moreUsers registered with email verification can self re-activate their disabled accountsCVE-2021-32620Fix available8.8 High
- xwiki, xwiki xwiki-platform +1 moreScript injection without script or programming rights through Gadget titlesCVE-2021-32621Fix available8.8 High
- xwiki, xwiki xwiki-platform +1 moreXSS Cross Site ScriptingCVE-2021-29459Fix available9.6 Critical
- xwiki, xwiki xwiki-platform +1 moreRating Script Service expose XWiki to SQL injectionCVE-2021-21380Public exploitFix available7.7 High
- xwiki, xwiki xwiki-platform +1 moreIt's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macroCVE-2021-21379Fix available7.7 High
- xwikiCross Site Scripting (XSS) in XWikiCVE-2021-3137Fix available5.4 Medium
- xwikiImproper escaping in XWiki PlatformCVE-2020-13654Public exploitFix available7.5 High
- xwiki, xwiki xwiki-platform +1 moreRCE in XWikiCVE-2020-15252Fix available8.5 High
- xwiki, xwiki xwiki-platform +1 moreUsers with SCRIPT rights can execute arbitrary code in XWikiCVE-2020-15171Fix available6.6 Medium
- xwiki, xwiki platform +1 moreCode Injection in XWiki PlatformCVE-2020-110579.9 Critical
- xwiki cryptpadThe pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has...CVE-2019-153026.5 Medium
- xwikiXWiki XSS VulnerabilityCVE-2018-162775.4 Medium
- xwiki cryptpadCross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows...CVE-2017-10000516.1 Medium
- xwiki enterpriseMultiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote...CVE-2012-10194.3 Medium
- xwikiCross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers...CVE-2010-46424.3 Medium
- xwikiSQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute...CVE-2010-46417.5 High
- xwiki watchMultiple cross-site scripting (XSS) vulnerabilities in XWiki Watch 1.0 allow remote attackers to...CVE-2010-46404.3 Medium
- xwikiUnspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows...CVE-2007-48982.1 Low
- xwikiThe "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable...CVE-2007-48883.5 Low
- xwikiXWiki Remote Code ExecutionCVE-2006-7223Fix available6.5 Medium
- xwikiThe search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote...CVE-2005-48625.0 Medium