XW
Product
xwiki-platform
On CISA KEVExploited in the wild
180
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 25High 94Medium 59Low 2
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-37909 | 8.8 | Oct 25 | Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet Affected: >= 5.1-rc-1, < 14.10.8; >= 15.0-rc-1, < 15.3-rc-1 |
| CVE-2023-40573 | 8.8 | Aug 24 | XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution Affected: < 14.10.9; >= 1.3; >= 15.0-rc-1, < 15.4-rc-1 |
| CVE-2023-40177 | 8.8 | Aug 23 | XWiki Platform privilege escalation (PR) from account through AWM content fields Affected: >= 4.3-milestone-2, < 14.10.5 |
| CVE-2023-37914 | 8.8 | Aug 17 | Privilege escalation (PR)/RCE from account through Invitation subject/message Affected: >= 2.5-m1, < 14.4.8; >= 14.5.0, < 14.10.6; >= 15.0, < 15.2-rc-1 |
| CVE-2023-37462 | 8.8 | Jul 14 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui Affected: >= 7.0-rc-1, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-36468 | 8.8 | Jun 29 | Upgrading doesn't prevent exploiting vulnerable XWiki documents Affected: >= 2.0, < 14.10.7; >= 15.0-rc-1, < 15.2-rc-1 |
| CVE-2023-36469 | 8.8 | Jun 29 | Code injection through NotificationRSSService in XWiki Platform Affected: >= 9.6-rc-1, < 14.10.6; >= 15.0-rc-1, < 15.2-rc-1 |
| CVE-2023-36470 | 8.8 | Jun 29 | Code injection in icon themes of XWiki Platform Affected: >= 6.2-milestone-1, < 14.10.6 |
| CVE-2023-35152 | 8.8 | Jun 23 | XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults Affected: >= 12.9-rc-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.1 |
| CVE-2023-35166 | 8.8 | Jun 20 | Privilege escalation (PR) from account through TipsPanel Affected: >= 8.1-milestone-1, < 14.10.5; >= 15.0-rc-1, < 15.1-rc-1 |
| CVE-2023-32069 | 8.8 | May 9 | XWiki Platform privilege escalation (PR)/RCE from account through class sheet Affected: >= 3.3-milestone-3, < 14.10.4 |
| CVE-2023-29516 | 8.8 | Apr 18 | Code injection from view right on XWiki.AttachmentSelector in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29514 | 8.8 | Apr 18 | Code injection in template provider administration in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29512 | 8.8 | Apr 18 | Code injection in xwiki-platform-web-templates Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29510 | 8.8 | Apr 18 | Code injection via unescaped translations in xwiki-platform Affected: < 14.10.2 |
| CVE-2023-29522 | 8.8 | Apr 18 | Code injection from view right on XWiki.ClassSheet in xwiki-platform Affected: < 14.4.8; >= 14.5.0, < 14.10.3 |
| CVE-2023-29521 | 8.8 | Apr 18 | Code injection from account/view through VFS Tree macro in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.2 |
| CVE-2023-29519 | 8.8 | Apr 18 | Code injection in org.xwiki.platform:xwiki-platform-attachment-ui Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.2 |
| CVE-2023-29518 | 8.8 | Apr 18 | Code injection from view right using Invitation.InvitationCommon in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29523 | 8.8 | Apr 18 | Code injection in display method used in user profiles in xwiki-platform Affected: >= 3.3-milestone-1, < 13.10.11; >= 14.0-rc-1, < 14.4.8; >= 14.5, < 14.10.1 |
| CVE-2023-29524 | 8.8 | Apr 18 | Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform Affected: < 14.10.3 |
| CVE-2023-29525 | 8.8 | Apr 18 | Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform Affected: < 14.4.8; >= 14.5.0, < 14.10.3. |
| CVE-2023-29526 | 8.8 | Apr 18 | Async and display macro allow displaying and interacting with any document in restricted mode Affected: >= 10.11.1, < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.3 |
| CVE-2023-29527 | 8.8 | Apr 18 | Code injection from account through AWM view sheet in xwiki platform Affected: >= 7.4.4, < 14.10.3 |
| CVE-2023-29213 | 8.8 | Apr 17 | org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability Affected: >= 4.2-milestone-3, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-29511 | 8.8 | Apr 16 | xwiki-platform-administration-ui vulnerable to privilege escalation Affected: >= 14.0-rc-1, < 14.4.8; >= 14.5, < 14.10.1; >= 1.5M2, < 13.10.11 |
| CVE-2023-30537 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation Affected: >= 12.6.6, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-29509 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability Affected: >= 7.2-rc-1, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-29214 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability Affected: >= 1.1-M2, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-29212 | 8.8 | Apr 16 | xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability Affected: >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-29211 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability Affected: >= 5.3-milestone-2, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-29210 | 8.8 | Apr 15 | org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability Affected: >= 13.2-rc-1, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-29209 | 8.8 | Apr 15 | org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability Affected: >= 10.9, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-26471 | 8.8 | Mar 2 | XWiki Platform users may execute anything with superadmin right through comments and async macro Affected: >= 11.6-rc-1, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9 |
| CVE-2023-26472 | 8.8 | Mar 2 | XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile Affected: >= 6.2-milestone-1, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9 |
| CVE-2023-26474 | 8.8 | Mar 2 | XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author Affected: >= 13.10, < 13.10.11; >= 14.0, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-26475 | 8.8 | Mar 2 | XWiki Platform vulnerable to Remote Code Execution in Annotations Affected: >= 2.3-milestone-1, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2026-34151 | 8.2 | Sep 14 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ Affected: < 17.10.5; >= 18.0.0-rc-1, < 18.2.0 |
| CVE-2023-37910 | 8.1 | Oct 25 | org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move Affected: >= 14.0-rc-1, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-34465 | 8.1 | Jun 23 | XWiki Platform's Mail.MailConfig can be edited by any user with edit rights Affected: >= 11.8-rc-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.1 |
| CVE-2023-26478 | 8.1 | Mar 2 | org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function Affected: >= 14.3-rc-1, < 14.4.6; >= 14.5, < 14.9-rc-1 |
| CVE-2025-49587 | 8.0 | Jun 13 | XWiki does not require right warnings for notification displayer objects Affected: >= 15.9-rc-1, < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 |
| CVE-2025-49585 | 8.0 | Jun 13 | XWiki does not require right warnings for XClass definitions Affected: < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 |
| CVE-2025-49582 | 8.0 | Jun 13 | XWiki's required right warnings for macros are incomplete Affected: >= 15.9-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-49580 | 8.0 | Jun 13 | XWiki allows privilege escalation through link refactoring Affected: >= 17.0.0-rc-1, < 17.1.0-rc-1; >= 16.5.0-rc-1, < 16.10.4; >= 8.2, < 16.4.7; >= 7.4.5, < 8.0-milestone-1 |
| CVE-2025-23025 | 8.0 | Jan 14 | Privilege escalation (PR) through realtime WYSIWYG editing in XWiki Affected: >= 13.9-rc-1, < 15.10.12; >= 16.0.0, < 16.4.1; >= 16.5.0, < 16.6.0-rc-1 |
| CVE-2024-43401 | 8.0 | Aug 19 | In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them Affected: < 15.10-rc-1 |
| CVE-2024-37899 | 8.0 | Jun 20 | Disabling a user account changes its author, allowing RCE from user account in XWiki Affected: >= 13.4.7, <= 13.5; >= 13.10.3, < 14.10.21; >= 15.0-rc-1, < 15.5.5; >= 15.6-rc-1, < 15.10.6; >= 16.0.0-rc-1, < 16.0.0 |
| CVE-2023-45135 | 8.0 | Oct 25 | XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title Affected: >= 7.2-milestone-2, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1 |
| CVE-2023-40572 | 8.0 | Aug 24 | XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action Affected: >= 3.2-milestone-3, < 14.10.9; >= 15.0-rc-1, < 15.4-rc-1 |