XW
Product
xwiki-platform
On CISA KEVExploited in the wild
230
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 29High 114Medium 84Low 3
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-29508 | 5.4 | Apr 16 | org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting Affected: >= 13.10.10, < 13.10.11; >= 14.4, < 14.4.7; >= 14.9, < 14.10 |
| CVE-2023-29206 | 5.4 | Apr 15 | org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins Affected: >= 3.0-milestone-1, < 14.9-rc-1 |
| CVE-2023-29205 | 5.4 | Apr 15 | org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro Affected: < 14.8-rc-1 |
| CVE-2023-26056 | 5.4 | Mar 2 | XWiki Platform allows macro execution as any user without programming rights through the context macro Affected: >= 3.0-milestone-1, < 13.10.10; >= 14.0-rc-1, < 14.4.5; >= 14.5, < 14.8-rc-1 |
| CVE-2023-26480 | 5.4 | Mar 2 | XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data Affected: >= 12.10, < 13.10.10; >= 14.0, < 14.4.7; >= 14.5, < 14.9 |
| CVE-2022-23620 | 5.4 | Feb 9 | Path traversal in xwiki-platform-skin-skinx Affected: >= 6.2-rc-1, < 13.6 |
| CVE-2022-23615 | 5.4 | Feb 9 | Partial authorization bypass on document save in xwiki-platform Affected: >= 1.0, < 13.0 |
| CVE-2021-43841 | 5.4 | Feb 4 | XSS by SVG upload in xwiki-platform Affected: < 12.10.6; >= 13.0, < 13.3RC1 |
| CVE-2021-32729 | 5.4 | Jul 1 | A user without PR can reset user authentication failures information Affected: > 11.6RC1, < 12.6.8; >= 12.10.0, < 12.10.4 |
| CVE-2021-21379 | 5.4 | Mar 12 | It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro Affected: >= 11.4.0, < 11.10.11; >= 12.0.0, < 12.6.3; >= 12.7.0, < 12.8-rc-1 |
| CVE-2025-46554 | 5.3 | Apr 30 | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API Affected: >= 1.8.1, < 14.10.22; >= 15.0-rc-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.7.0 |
| CVE-2025-32972 | 5.3 | Apr 30 | The lesscss script service allows cache clearing without programming right Affected: >= 6.1-milestone-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.8.0-rc-1 |
| CVE-2025-29925 | 5.3 | Mar 19 | XWiki allows unregistered users to access private pages information through REST endpoint Affected: >= 1.9M1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1 |
| CVE-2024-46979 | 5.3 | Sep 18 | Data leak of notification filters of users in XWiki Platform Affected: >= 13.2-rc-1, < 14.10.21; >= 15.0.0, < 15.5.5; >= 15.6.0, < 15.10.1 |
| CVE-2024-45591 | 5.3 | Sep 10 | XWiki Platform document history including authors of any page exposed to unauthorized actors Affected: >= 1.8.0, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0-rc-1 |
| CVE-2023-50720 | 5.3 | Dec 15 | XWiki Platform Solr search discloses email addresses of users Affected: < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 |
| CVE-2023-29203 | 5.3 | Apr 15 | Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm Affected: >= 13.9-rc-1, < 13.10.8; >= 14.0-rc-1, < 14.4.3; >= 14.5, < 14.7-rc-1 |
| CVE-2022-41932 | 5.3 | Nov 23 | Creation of new database tables through login form on PostgreSQL Affected: < 13.10.8; >= 14.0.0, < 14.4.2; >= 14.5.0, < 14.6-rc-1 |
| CVE-2022-24820 | 5.3 | Apr 8 | Unauthenticated user can list hidden document from multiple velocity templates Affected: < 8.4.5, < 10.11.8, < 11.3.1, < 13.6-rc-1 |
| CVE-2022-24819 | 5.3 | Apr 8 | Unauthenticated user can retrieve the list of users through uorgsuggest.vm Affected: < 4.3 |
| CVE-2021-32731 | 5.3 | Jul 1 | The reset password form reveal users email address Affected: >= 13.1RC1, <= 13.1 |
| CVE-2024-31464 | 4.9 | Apr 10 | XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted Affected: >= 5.0-rc-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1 |
| CVE-2022-41929 | 4.9 | Nov 23 | Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore Affected: >= 11.7RC1, < 13.10.7; >= 14.0.0, < 14.4.2 |
| CVE-2022-23621 | 4.9 | Feb 9 | Missing authorization in xwiki-platform Affected: >= 13.6.0, < 13.7-rc-1; >= 13.0.0, < 13.4.3; < 12.10.9 |
| CVE-2023-35157 | 4.8 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via delattachment action Affected: >= 3.2-milestone-3, < 14.10.6; >= 15.0-rc-0, < 15.1-rc-1 |
| CVE-2024-37900 | 4.6 | Jul 31 | XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader Affected: >= 4.2-milestone-3, < 14.10.21; >= 15.0-rc-1, < 15.5.5; >= 15.6-rc-1, < 15.10.6; >= 16.0.0-rc-1, < 16.0.0 |
| CVE-2025-32783 | 4.3 | Apr 16 | XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki Affected: >= 5.0, <= 16.7.1 |
| CVE-2024-37898 | 4.3 | Jul 31 | XWiki Platform vulnerable to document deletion and overwrite from edit Affected: >= 13.10.4, < 14.0-rc-1; >= 14.2, < 14.10.21; >= 15.0, < 15.5.5; >= 15.6-rc-1, < 15.10.6 |
| CVE-2024-38369 | 4.3 | Jun 24 | XWiki programming rights may be inherited by inclusion Affected: >= 1.5-milestone-2, < 15.0-rc-1 |
| CVE-2023-38509 | 4.3 | Jul 27 | XWiki Platform's obfuscated email addresses should not be sorted Affected: >= 3.5-milestone-1, < 14.10.9; >= 15.0, < 15.3-rc-1 |
| CVE-2023-34466 | 4.3 | Jun 23 | XWiki Platform's tags on non-viewable pages can be revealed to users Affected: >= 5.0-milestone-1, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-29513 | 4.3 | Apr 18 | Users can be created even when registration is disabled without validation via the template macro in xwiki-platform Affected: < 14.10.1 |
| CVE-2022-41935 | 4.3 | Nov 23 | Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui Affected: >= 12.10.11, < 13.10.8; >= 14.0.0, < 14.4.3 |
| CVE-2022-36095 | 4.3 | Sep 8 | XWiki Cross-Site Request Forgery (CSRF) for actions on tags Affected: >= 2.0-milestone-1, < 13.10.5; >= 14.0, < 14.3 |