Skip to content
Xwikisas vulnerabilities
Newest
-
xwikisas xwiki-pro-macros
XWiki Pro Macros: excerpt-include title and content injection executes code
CVE-2026-44179
Fix available
9.9 Critical
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro
CVE-2025-65036
8.3 High
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki view file macro: User can view content of office file without view rights on the attachment
CVE-2025-65089
Fix available
6.8 Medium
-
xwikisas application-admintools
XWiki AdminTools application doesn't set permissions on the AdminTools space
CVE-2025-54990
Fix available
5.3 Medium
-
xwikisas xwiki-pro-macros
XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro
CVE-2025-55730
10.0 Critical
-
xwikisas xwiki-pro-macros
XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro
CVE-2025-55729
10.0 Critical
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki Remote Macros vulnerable to remote code execution using the panel macro
CVE-2025-55728
10.0 Critical
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro
CVE-2025-55727
10.0 Critical
-
xwikisas application-urlshortener
application-urlshortener users can create arbitrary pages as long as they have view access to them
CVE-2025-48885
5.7 Medium
-
xwiki confluence migrator, xwikisas application-confluence-migrator-pro +1 more
XWiki Confluence Migrator Pro's homepage is public
CVE-2025-27604
Fix available
7.5 High
-
xwikisas application-confluence-migrator-pro
XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations
CVE-2025-27603
Fix available
9.1 Critical
-
xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 more
macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author
CVE-2024-52298
7.5 High
-
xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 more
The PDF viewer macro allows accessing any attachment without access right checks
CVE-2024-52299
7.5 High
-
xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 more
macro-pdfviewer has a XSS through the width parameter
CVE-2024-52300
9.1 Critical
-
xwiki pro macros, xwikisas xwiki-pro-macros +1 more
Pro Macros Remote Code Execution via Viewpdf and similar macros
CVE-2024-42489
10.0 Critical
-
xwikisas macro-pdfviewer, macro pdfviewer +1 more
The PDF Viewer macro can be used to view PDF attachments with restricted access
CVE-2024-30263
7.7 High
-
xwiki application licensing, xwikisas application-licensing +1 more
License information is public, exposing instance id and license holder details
CVE-2024-26138
Fix available
5.3 Medium
-
xwiki, xwiki-contrib application-admintools +1 more
XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries
CVE-2023-48293
Fix available
8.8 High
-
xwiki admin tools, xwiki-contrib application-admintools +1 more
XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks
CVE-2023-48292
Public exploitFix available
EPSS 22.9%
9.7 Critical
-
xwiki application-collabora
The same file cannot be opened with different rights
CVE-2023-46743
7.4 High
-
xwiki oauth identity, xwikisas identity-oauth +1 more
Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App
CVE-2023-45144
Fix available
10.0 Critical