Skip to contentXwiki vulnerabilities
Newest
- xwiki, xwiki xwiki-platform +1 moreXWiki has no right protection on rollback actionCVE-2024-21648Fix available8.0 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Remote Code Execution vulnerability via user registrationCVE-2024-21650Fix availableEPSS 93.5%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreVelocity execution without script right through tree macroCVE-2023-50732Fix available8.3 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution/programming rights with configuration section from any user accountCVE-2023-50723Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClassCVE-2023-50722Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform RCE from account through SearchAdminCVE-2023-50721Fix availableEPSS 78.8%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses password hashes of all usersCVE-2023-50719Fix availableEPSS 83.5%7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses email addresses of usersCVE-2023-50720Fix availableEPSS 59.1%5.3 Medium
- xwiki change request, xwiki-contrib application-changerequest +1 moreData leak of password hash through xwiki change requestCVE-2023-49280Fix available7.7 High
- xwiki, xwiki-contrib application-admintools +1 moreXWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queriesCVE-2023-48293Fix available8.8 High
- xwiki admin tools, xwiki-contrib application-admintools +1 moreXWiki Admin Tools Application Run Shell Command allows CSRF RCE attacksCVE-2023-48292Public exploitFix availableEPSS 22.9%9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest serviceCVE-2023-48241Fix availableEPSS 72.8%7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgeryCVE-2023-48240Fix available9.1 Critical
- xwiki application-collaboraThe same file cannot be opened with different rightsCVE-2023-467437.4 High
- xwiki, xwiki xwiki-platform +1 moreCode execution via the edit action in XWiki platformCVE-2023-46243Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection in XWiki PlatformCVE-2023-46242Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation in Xwiki platformCVE-2023-46244Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreRemote code execution through the section parameter in Administration as guest in XWiki PlatformCVE-2023-46731Fix availableEPSS 89.7%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreReflected Cross-site scripting through revision parameter in content menu in XWiki PlatformCVE-2023-46732Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS with edit right in the create document form for existing pagesCVE-2023-45137Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabledCVE-2023-45136Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki users can be tricked to execute scripts as the create page action doesn't display the page's titleCVE-2023-45135Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS vulnerability from account in the create page form via template providerCVE-2023-45134Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converterCVE-2023-37913Fix available10.0 Critical
- xwiki xwiki-renderingXWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macroCVE-2023-37912Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documentsCVE-2023-37911Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment MoveCVE-2023-37910Fix available8.1 High
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheetCVE-2023-37909Fix available10.0 Critical
- xwiki xwiki-renderingorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityCVE-2023-37908Public exploitFix available9.1 Critical
- xwiki oauth identity, xwikisas identity-oauth +1 moreRemote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki AppCVE-2023-45144Fix available10.0 Critical
- xwiki change request, xwiki-contrib application-changerequest +1 moreChange Request Application vulnerable to XSS and remote code execution through change request titleCVE-2023-45138Fix availableEPSS 71.7%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreVelocity execution without script rights in Xwiki platformCVE-2023-41046Fix available6.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's Groovy jobs check the wrong author, allowing remote code executionCVE-2023-40573Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to CSRF privilege escalation/RCE via the create actionCVE-2023-40572Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform privilege escalation (PR) from account through AWM content fieldsCVE-2023-40177Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreSXSS in the user profile via the timezone displayerCVE-2023-40176Fix availableEPSS 80.0%9.1 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR)/RCE from account through Invitation subject/messageCVE-2023-37914Fix available9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's obfuscated email addresses should not be sortedCVE-2023-38509Fix available4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiCVE-2023-37462Fix availableEPSS 91.6%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST APICVE-2023-37277Fix available9.7 Critical
- xwiki ckeditor integration, xwiki, xwiki xwiki-platform +2 morePersistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki PlatformCVE-2023-36477Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreUpgrading doesn't prevent exploiting vulnerable XWiki documentsCVE-2023-36468Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection through NotificationRSSService in XWiki PlatformCVE-2023-36469Fix availableEPSS 82.0%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection in icon themes of XWiki PlatformCVE-2023-36470Fix available10.0 Critical
- xwiki commons, xwiki-commons +1 moreHTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xmlCVE-2023-36471Public exploitFix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication pageCVE-2023-35161Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit templateCVE-2023-35160Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace templateCVE-2023-35159Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore templateCVE-2023-35158Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via delattachment actionCVE-2023-35157Fix available8.5 High
- Show moreLoading…