XW
Product
xwiki-platform
On CISA KEVExploited in the wild
222
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 29High 111Medium 79Low 3
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-49586 | 8.8 | Jun 13 | XWiki allows remote code execution through preview of XClass changes in AWM editor Affected: >= 7.2-milestone-2, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-49581 | 8.8 | Jun 13 | XWiki allows remote code execution through default value of wiki macro wiki-type parameters Affected: >= 11.10.11, < 12.0; >= 12.6.3, < 12.7; >= 12.8-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-48063 | 8.8 | May 21 | XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right Affected: >= 16.10.0-rc-1, < 16.10.4; >= 17.0.0-rc-1, < 17.1.0-rc-1 |
| CVE-2025-32968 | 8.8 | Apr 23 | org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API Affected: >= 1.6-milestone-1, < 15.10.16; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.1 |
| CVE-2024-55879 | 8.8 | Dec 12 | XWiki allows RCE from script right in configurable sections Affected: >= 2.3, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0 |
| CVE-2024-55877 | 8.8 | Dec 12 | XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Affected: >= 9.7-rc-1, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1; >= 16.5.0-rc-1, < 16.5.0 |
| CVE-2024-55662 | 8.8 | Dec 12 | XWiki allows remote code execution through the extension sheet Affected: >= 3.3-milestone-1, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0 |
| CVE-2024-37901 | 8.8 | Jul 31 | XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Affected: >= 15.6-rc-1, < 15.10.2; >= 15.0-rc-1, < 15.5.5; >= 9.2-rc-1, < 14.10.21 |
| CVE-2024-31997 | 8.8 | Apr 10 | XWiki Platform remote code execution from account through UIExtension parameters Affected: < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1 |
| CVE-2024-31988 | 8.8 | Apr 10 | XWiki Platform CSRF remote code execution through the realtime HTML Converter API Affected: >= 13.9-rc-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9 |
| CVE-2024-31987 | 8.8 | Apr 10 | XWiki Platform remote code execution from account via custom skins support Affected: >= 6.4-milestone-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1 |
| CVE-2024-31986 | 8.8 | Apr 10 | XWiki Platform CSRF remote code execution through scheduler job's document reference Affected: >= 3.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9 |
| CVE-2024-31984 | 8.8 | Apr 10 | XWiki Platform: Remote code execution through space title and Solr space facet Affected: >= 7.2-rc-1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1 |
| CVE-2024-31983 | 8.8 | Apr 10 | XWiki Platform: Remote code execution from edit in multilingual wikis via translations Affected: >= 4.3-milestone-2, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1 |
| CVE-2024-31981 | 8.8 | Apr 10 | XWiki Platform: Privilege escalation (PR) from user registration through PDFClass Affected: >= 3.0.1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1 |
| CVE-2024-31465 | 8.8 | Apr 10 | XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet Affected: >= 5.2-milestone-2, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1 |
| CVE-2024-21648 | 8.8 | Jan 8 | XWiki has no right protection on rollback action Affected: >= 1.0, < 14.10.17; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1 |
| CVE-2023-50723 | 8.8 | Dec 15 | XWiki Platform remote code execution/programming rights with configuration section from any user account Affected: >= 2.3, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 |
| CVE-2023-50722 | 8.8 | Dec 15 | XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass Affected: >= 2.3, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 |
| CVE-2023-50721 | 8.8 | Dec 15 | XWiki Platform RCE from account through SearchAdmin Affected: >= 4.5-rc-1, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 |
| CVE-2023-48240 | 8.8 | Nov 20 | XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery Affected: >= 11.10.1, < 14.10.15; >= 15.0-rc-1, < 15.5.1; >= 15.6-rc-1, < 15.6 |
| CVE-2023-46243 | 8.8 | Nov 7 | Code execution via the edit action in XWiki platform Affected: >= 1.0, < 14.10.6 |
| CVE-2023-46242 | 8.8 | Nov 7 | Code injection in XWiki Platform Affected: >= 1.0, < 14.10.7 |
| CVE-2023-46244 | 8.8 | Nov 7 | Privilege escalation in Xwiki platform Affected: >= 3.2-milestone-3, < 14.10.7 |
| CVE-2023-37913 | 8.8 | Oct 25 | org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter Affected: >= 3.5-milestone-1, < 14.10.8; >= 15.0-rc-1, < 15.3-rc-1 |
| CVE-2023-37909 | 8.8 | Oct 25 | Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet Affected: >= 5.1-rc-1, < 14.10.8; >= 15.0-rc-1, < 15.3-rc-1 |
| CVE-2023-40573 | 8.8 | Aug 24 | XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution Affected: < 14.10.9; >= 1.3; >= 15.0-rc-1, < 15.4-rc-1 |
| CVE-2023-40177 | 8.8 | Aug 23 | XWiki Platform privilege escalation (PR) from account through AWM content fields Affected: >= 4.3-milestone-2, < 14.10.5 |
| CVE-2023-37914 | 8.8 | Aug 17 | Privilege escalation (PR)/RCE from account through Invitation subject/message Affected: >= 2.5-m1, < 14.4.8; >= 14.5.0, < 14.10.6; >= 15.0, < 15.2-rc-1 |
| CVE-2023-37462 | 8.8 | Jul 14 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui Affected: >= 7.0-rc-1, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-36468 | 8.8 | Jun 29 | Upgrading doesn't prevent exploiting vulnerable XWiki documents Affected: >= 2.0, < 14.10.7; >= 15.0-rc-1, < 15.2-rc-1 |
| CVE-2023-36469 | 8.8 | Jun 29 | Code injection through NotificationRSSService in XWiki Platform Affected: >= 9.6-rc-1, < 14.10.6; >= 15.0-rc-1, < 15.2-rc-1 |
| CVE-2023-36470 | 8.8 | Jun 29 | Code injection in icon themes of XWiki Platform Affected: >= 6.2-milestone-1, < 14.10.6 |
| CVE-2023-35152 | 8.8 | Jun 23 | XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults Affected: >= 12.9-rc-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.1 |
| CVE-2023-35166 | 8.8 | Jun 20 | Privilege escalation (PR) from account through TipsPanel Affected: >= 8.1-milestone-1, < 14.10.5; >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-32069 | 8.8 | May 9 | XWiki Platform privilege escalation (PR)/RCE from account through class sheet Affected: >= 3.3-milestone-3, < 14.10.4 |
| CVE-2023-29516 | 8.8 | Apr 18 | Code injection from view right on XWiki.AttachmentSelector in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29514 | 8.8 | Apr 18 | Code injection in template provider administration in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29512 | 8.8 | Apr 18 | Code injection in xwiki-platform-web-templates Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29510 | 8.8 | Apr 18 | Code injection via unescaped translations in xwiki-platform Affected: < 14.10.2 |
| CVE-2023-29522 | 8.8 | Apr 18 | Code injection from view right on XWiki.ClassSheet in xwiki-platform Affected: < 14.4.8; >= 14.5.0, < 14.10.3 |
| CVE-2023-29521 | 8.8 | Apr 18 | Code injection from account/view through VFS Tree macro in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.2 |
| CVE-2023-29519 | 8.8 | Apr 18 | Code injection in org.xwiki.platform:xwiki-platform-attachment-ui Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.2 |
| CVE-2023-29518 | 8.8 | Apr 18 | Code injection from view right using Invitation.InvitationCommon in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29523 | 8.8 | Apr 18 | Code injection in display method used in user profiles in xwiki-platform Affected: >= 3.3-milestone-1, < 13.10.11; >= 14.0-rc-1, < 14.4.8; >= 14.5, < 14.10.1 |
| CVE-2023-29524 | 8.8 | Apr 18 | Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform Affected: < 14.10.3 |
| CVE-2023-29525 | 8.8 | Apr 18 | Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform Affected: < 14.4.8; >= 14.5.0, < 14.10.3. |
| CVE-2023-29526 | 8.8 | Apr 18 | Async and display macro allow displaying and interacting with any document in restricted mode Affected: >= 10.11.1, < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.3 |
| CVE-2023-29527 | 8.8 | Apr 18 | Code injection from account through AWM view sheet in xwiki platform Affected: >= 7.4.4, < 14.10.3 |
| CVE-2023-29213 | 8.8 | Apr 17 | org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability Affected: >= 4.2-milestone-3, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |