Login Request a demo
XW
Product
xwiki-platform
by xwiki · last CVE Sep 15, 2026
On CISA KEVExploited in the wild
204
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities204In the news1Timeline
Severity mix
Critical 28High 108Medium 66Low 2
Severity
All severities204Critical28High108Medium66Low2
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add xwiki-platform to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-24893
In wildKEV
9.8
100%
Feb 20
Remote code execution as guest via SolrSearchMacros request in xwiki
Affected: >= 5.3-milestone-2, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1
CVE-2023-27479
9.9
1%
Mar 7
Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
Affected: >= 6.3-milestone-2, < 13.10.11; >= 14.0.0, < 14.4.7; >= 14.5.0, < 14.10-rc-1
CVE-2026-33229
9.8
1%
Apr 8
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
Affected: >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1
CVE-2025-54385
9.8
1%
Jul 26
XWiki Platform's searchDocuments API allows for SQL injection
Affected: < 16.10.6; >= 17.0.0-rc1, < 17.3.0-rc-1
CVE-2025-32429
9.8
85%
Jul 24
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
Affected: >= 9.4-rc-1, < 16.10.6; >= 17.0.0-rc-1, < 17.3.0-rc-1
CVE-2024-56158
9.8
1%
Jun 12
XWiki allows SQL injection in query endpoint of REST API with Oracle
Affected: >= 1.0, < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2
CVE-2025-46557
9.8
1%
Apr 30
Any user with view access to the XWiki space can change the authenticator
Affected: >= 15.3-rc-1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1
CVE-2025-32969
9.8
80%
Apr 23
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
Affected: >= 1.8, < 15.10.16; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.1
CVE-2025-29926
9.8
1%
Mar 19
The WikiManager REST API allows any user to create wikis
Affected: >= 5.4-rc-1, < 15.10.15; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0
CVE-2024-55663
9.8
1%
Dec 12
XWiki Platform has an SQL injection in getdocuments.vm with sort parameter
Affected: >= 6.3-milestone-2, < 13.10.5; >= 14.0-rc-1, < 14.3-rc-1
CVE-2024-31982
9.8
35%
Apr 10
XWiki Platform: Remote code execution as guest via DatabaseSearch
Affected: >= 2.4-milestone-1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
CVE-2024-21650
9.8
93%
Jan 8
XWiki Remote Code Execution vulnerability via user registration
Affected: >= 2.2, < 14.10.17; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1
CVE-2023-46731
9.8
89%
Nov 6
Remote code execution through the section parameter in Administration as guest in XWiki Platform
Affected: org.xwiki.platform:xwiki-platform-administration : < 14.10.14; org.xwiki.platform:xwiki-platform-administration-ui: < 14.10.14; org.xwiki.platform:xwiki-platform-administration-ui: >= 15.0-rc-1, < 15.5.1
CVE-2023-26477
9.8
75%
Mar 2
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Affected: >= 6.2.4, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9-rc-1
CVE-2023-45136
9.6
5%
Oct 25
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
Affected: >= 12.0-rc-1, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1
CVE-2023-37277
9.6
1%
Jul 10
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
Affected: >= 1.8, < 14.10.8; >= 15.0-rc-1, < 15.2
CVE-2026-33137
9.3
1%
May 20
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Affected: >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1
CVE-2025-52472
9.3
2%
Oct 6
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
Affected: >= 4.3-milestone-1, < 16.10.9; >= 17.0.0-rc-1, < 17.4.2
CVE-2025-55747
9.1
2%
Sep 3
XWiki Platform's configuration files can be accessed through the webjars API
Affected: >= 6.1-milestone-2, < 16.10.7
CVE-2025-32973
9.0
0%
Apr 30
org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
Affected: >= 15.9-rc-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.8.0-rc-1
CVE-2025-32974
9.0
0%
Apr 30
org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
Affected: >= 15.9-rc-1, < 15.10.8; >= 16.0.0-rc-1, < 16.2.0
CVE-2023-45134
9.0
2%
Oct 25
XWiki Platform XSS vulnerability from account in the create page form via template provider
Affected: >= 3.1-milestone-1, < 13.4-rc-1; >= 2.4-milestone-2, < 3.1-milestone-1; >= 14.0-rc-1, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1
CVE-2023-32071
9.0
70%
May 9
XWiki Platform vulnerable to RXSS via editor parameter - importinline template
Affected: >= 2.2-milestone-1, < 14.4.8; >= 14.5, < 14.10.4
CVE-2023-29207
9.0
1%
Apr 15
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
Affected: >= 1.9-milestone-2, < 13.10.10; >= 14.0-rc-1, < 14.4.6; >= 14.5, < 14.9
CVE-2023-29202
9.0
1%
Apr 15
org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability
Affected: >= 1.8, <= 3.0.1; < 14.6-rc-1
CVE-2022-36098
9.0
72%
Sep 8
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
Affected: >= 12.5-rc-1, < 13.10.6; >= 14.0, < 14.4
CVE-2022-36096
9.0
60%
Sep 8
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
Affected: >= 2.2-milestone-1, < 13.10.6; >= 14.0, < 14.3
CVE-2022-36094
9.0
65%
Sep 8
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
Affected: >= 1.0, < 13.10.6; >= 14.0, < 14.3-rc-1
CVE-2025-49586
8.8
1%
Jun 13
XWiki allows remote code execution through preview of XClass changes in AWM editor
Affected: >= 7.2-milestone-2, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0
CVE-2025-49581
8.8
1%
Jun 13
XWiki allows remote code execution through default value of wiki macro wiki-type parameters
Affected: >= 11.10.11, < 12.0; >= 12.6.3, < 12.7; >= 12.8-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0
CVE-2025-48063
8.8
1%
May 21
XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right
Affected: >= 16.10.0-rc-1, < 16.10.4; >= 17.0.0-rc-1, < 17.1.0-rc-1
CVE-2025-32968
8.8
1%
Apr 23
org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
Affected: >= 1.6-milestone-1, < 15.10.16; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.1
CVE-2024-55879
8.8
1%
Dec 12
XWiki allows RCE from script right in configurable sections
Affected: >= 2.3, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0
CVE-2024-55877
8.8
2%
Dec 12
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
Affected: >= 9.7-rc-1, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1; >= 16.5.0-rc-1, < 16.5.0
CVE-2024-55662
8.8
1%
Dec 12
XWiki allows remote code execution through the extension sheet
Affected: >= 3.3-milestone-1, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0
CVE-2024-37901
8.8
1%
Jul 31
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Affected: >= 15.6-rc-1, < 15.10.2; >= 15.0-rc-1, < 15.5.5; >= 9.2-rc-1, < 14.10.21
CVE-2024-31997
8.8
74%
Apr 10
XWiki Platform remote code execution from account through UIExtension parameters
Affected: < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1
CVE-2024-31988
8.8
1%
Apr 10
XWiki Platform CSRF remote code execution through the realtime HTML Converter API
Affected: >= 13.9-rc-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9
CVE-2024-31987
8.8
1%
Apr 10
XWiki Platform remote code execution from account via custom skins support
Affected: >= 6.4-milestone-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
CVE-2024-31986
8.8
1%
Apr 10
XWiki Platform CSRF remote code execution through scheduler job's document reference
Affected: >= 3.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9
CVE-2024-31984
8.8
83%
Apr 10
XWiki Platform: Remote code execution through space title and Solr space facet
Affected: >= 7.2-rc-1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
CVE-2024-31983
8.8
1%
Apr 10
XWiki Platform: Remote code execution from edit in multilingual wikis via translations
Affected: >= 4.3-milestone-2, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
CVE-2024-31981
8.8
1%
Apr 10
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
Affected: >= 3.0.1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
CVE-2024-31465
8.8
76%
Apr 10
XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
Affected: >= 5.2-milestone-2, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
CVE-2024-21648
8.8
1%
Jan 8
XWiki has no right protection on rollback action
Affected: >= 1.0, < 14.10.17; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1
CVE-2023-50723
8.8
1%
Dec 15
XWiki Platform remote code execution/programming rights with configuration section from any user account
Affected: >= 2.3, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1
CVE-2023-50722
8.8
1%
Dec 15
XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
Affected: >= 2.3, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1
CVE-2023-50721
8.8
79%
Dec 15
XWiki Platform RCE from account through SearchAdmin
Affected: >= 4.5-rc-1, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1
CVE-2023-48240
8.8
1%
Nov 20
XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
Affected: >= 11.10.1, < 14.10.15; >= 15.0-rc-1, < 15.5.1; >= 15.6-rc-1, < 15.6
CVE-2023-46243
8.8
1%
Nov 7
Code execution via the edit action in XWiki platform
Affected: >= 1.0, < 14.10.6
Page 1 of 5 · 204 total
12…5