Skip to contentXwiki vulnerabilities
Newest
- xwiki, xwiki xwiki-platform +1 moreAny user with view access to the XWiki space can change the authenticatorCVE-2025-46557Fix available8.4 High
- xwiki, xwiki xwiki-platform +1 moreXWiki missing authorization when accessing the wiki level attachments list and metadata via REST APICVE-2025-46554Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content typeCVE-2025-32974Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming rightCVE-2025-32973Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreThe lesscss script service allows cache clearing without programming rightCVE-2025-32972Fix available2.7 Low
- xwiki, xwiki xwiki-platform +1 moreXWiki Solr script service doesn't take dropped programming right into accountCVE-2025-32971Fix available3.8 Low
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerabilityCVE-2025-32970Fix available6.1 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APICVE-2025-32969Fix availableEPSS 80.0%9.3 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query APICVE-2025-32968Fix available8.6 High
- xwiki, xwiki xwiki-platform +1 moreXWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wikiCVE-2025-327834.7 Medium
- xwiki, xwiki xwiki-platform +1 moreThe WikiManager REST API allows any user to create wikisCVE-2025-29926Fix available7.9 High
- xwiki, xwiki xwiki-platform +1 moreXWiki allows unregistered users to access private pages information through REST endpointCVE-2025-29925Fix available8.7 High
- xwiki, xwiki xwiki-platform +1 moreXWiki uses the wrong wiki reference in AuthorizationManagerCVE-2025-29924Fix available8.7 High
- xwiki confluence migrator, xwikisas application-confluence-migrator-pro +1 moreXWiki Confluence Migrator Pro's homepage is publicCVE-2025-27604Fix available7.5 High
- xwiki platform, xwiki, xwiki xwiki-platform +2 moreRemote code execution as guest via SolrSearchMacros request in xwikiCVE-2025-24893In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR) through realtime WYSIWYG editing in XWikiCVE-2025-23025Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki allows RCE from script right in configurable sectionsCVE-2024-55879Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosListCVE-2024-55877Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki's scheduler in subwiki allows scheduling operations for any main wiki userCVE-2024-55876Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform has an SQL injection in getdocuments.vm with sort parameterCVE-2024-55663Fix available8.6 High
- xwiki, xwiki xwiki-platform +1 moreXWiki allows remote code execution through the extension sheetCVE-2024-55662Fix available10.0 Critical
- xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 moremacro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last authorCVE-2024-522987.5 High
- xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 moreThe PDF viewer macro allows accessing any attachment without access right checksCVE-2024-522997.5 High
- xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 moremacro-pdfviewer has a XSS through the width parameterCVE-2024-523009.1 Critical
- xwiki, xwiki xwiki-platform +1 moreData leak of notification filters of users in XWiki PlatformCVE-2024-46979Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreMissing checks for notification filter preferences editions in XWiki PlatformCVE-2024-46978Fix available6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform document history including authors of any page exposed to unauthorized actorsCVE-2024-45591Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform allows XSS through XClass name in string propertiesCVE-2024-43400Public exploitFix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themCVE-2024-43401Fix available9.1 Critical
- xwiki pro macros, xwikisas xwiki-pro-macros +1 morePro Macros Remote Code Execution via Viewpdf and similar macrosCVE-2024-4248910.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS through conflict resolutionCVE-2024-41947Public exploitFix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheetCVE-2024-37901Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploaderCVE-2024-37900Fix availableEPSS 15.8%6.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to document deletion and overwrite from editCVE-2024-37898Fix available4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki programming rights may be inherited by inclusionCVE-2024-38369Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreDisabling a user account changes its author, allowing RCE from user account in XWikiCVE-2024-37899Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution from account through UIExtension parametersCVE-2024-31997Fix availableEPSS 73.9%10.0 Critical
- xwiki commons, xwiki, xwiki xwiki-commons +2 moreXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionCVE-2024-31996Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF remote code execution through the realtime HTML Converter APICVE-2024-31988Fix available9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution from account via custom skins supportCVE-2024-31987Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF remote code execution through scheduler job's document referenceCVE-2024-31986Fix available9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF in the job schedulerCVE-2024-31985Fix available5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution through space title and Solr space facetCVE-2024-31984Fix availableEPSS 83.0%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution from edit in multilingual wikis via translationsCVE-2024-31983Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution as guest via DatabaseSearchCVE-2024-31982Public exploitFix availableEPSS 34.5%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Privilege escalation (PR) from user registration through PDFClassCVE-2024-31981Fix available10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution from account via SearchSuggestSourceSheetCVE-2024-31465Fix availableEPSS 75.6%10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Password hash might be leaked by diff once the xobject holding them is deletedCVE-2024-31464Fix available6.8 Medium
- xwiki application licensing, xwikisas application-licensing +1 moreLicense information is public, exposing instance id and license holder detailsCVE-2024-26138Fix available5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Denial of Service attack through attachmentsCVE-2024-21651Fix available7.5 High
- Show moreLoading…