XW
Product
xwiki-platform
On CISA KEVExploited in the wild
212
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 29High 109Medium 71Low 3
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-34465 | 8.1 | Jun 23 | XWiki Platform's Mail.MailConfig can be edited by any user with edit rights Affected: >= 11.8-rc-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.1 |
| CVE-2023-26478 | 8.1 | Mar 2 | org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function Affected: >= 14.3-rc-1, < 14.4.6; >= 14.5, < 14.9-rc-1 |
| CVE-2022-41937 | 8.1 | Nov 22 | Missing Authorization in XWiki Platform Affected: < 13.10.8; >= 14.0.0, < 14.4.3; >= 14.5.0, < 14.6-rc-1 |
| CVE-2022-36090 | 8.1 | Sep 8 | org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users Affected: >= 1.1, < 13.10.5; >= 14.0, < 14.3-RC-1 |
| CVE-2022-24821 | 8.1 | Apr 8 | Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx Affected: > 3.1M1 |
| CVE-2025-49587 | 8.0 | Jun 13 | XWiki does not require right warnings for notification displayer objects Affected: >= 15.9-rc-1, < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 |
| CVE-2025-49585 | 8.0 | Jun 13 | XWiki does not require right warnings for XClass definitions Affected: < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 |
| CVE-2025-49582 | 8.0 | Jun 13 | XWiki's required right warnings for macros are incomplete Affected: >= 15.9-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-49580 | 8.0 | Jun 13 | XWiki allows privilege escalation through link refactoring Affected: >= 17.0.0-rc-1, < 17.1.0-rc-1; >= 16.5.0-rc-1, < 16.10.4; >= 8.2, < 16.4.7; >= 7.4.5, < 8.0-milestone-1 |
| CVE-2025-23025 | 8.0 | Jan 14 | Privilege escalation (PR) through realtime WYSIWYG editing in XWiki Affected: >= 13.9-rc-1, < 15.10.12; >= 16.0.0, < 16.4.1; >= 16.5.0, < 16.6.0-rc-1 |
| CVE-2024-43401 | 8.0 | Aug 19 | In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them Affected: < 15.10-rc-1 |
| CVE-2024-37899 | 8.0 | Jun 20 | Disabling a user account changes its author, allowing RCE from user account in XWiki Affected: >= 13.4.7, <= 13.5; >= 13.10.3, < 14.10.21; >= 15.0-rc-1, < 15.5.5; >= 15.6-rc-1, < 15.10.6; >= 16.0.0-rc-1, < 16.0.0 |
| CVE-2023-45135 | 8.0 | Oct 25 | XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title Affected: >= 7.2-milestone-2, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1 |
| CVE-2023-40572 | 8.0 | Aug 24 | XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action Affected: >= 3.2-milestone-3, < 14.10.9; >= 15.0-rc-1, < 15.4-rc-1 |
| CVE-2023-35150 | 8.0 | Jun 23 | XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application Affected: >= 2.4-m-2, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-27480 | 7.7 | Mar 7 | Data leak through a XAR import XXE attack in xwiki-platform-xar-model Affected: >= 1.1-milestone-3, < 13.10.11; >= 14.0.0, < 14.4.7; >= 14.5.0, < 14.10.0-rc-1 |
| CVE-2026-48048 | 7.5 | Aug 10 | XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests Affected: >= 6.2.1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 |
| CVE-2025-66473 | 7.5 | Dec 10 | XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis Affected: < 16.10.11; >= 17.0.0-rc-1, < 17.4.4; >= 17.5.0-rc-1, < 17.7.0-rc-1 |
| CVE-2025-55749 | 7.5 | Dec 1 | The XWiki Jetty package (XJetty) allows accessing any application file through URL Affected: >= 16.7.0, < 16.10.11; >= 17.0.0-rc1, < 17.4.4; >= 17.5.0, < 17.7.0 |
| CVE-2025-55748 | 7.5 | Sep 3 | XWiki Platform's configuration files can be accessed through jsx and sx endpoints Affected: >= 4.2-milestone-2, < 16.10.7 |
| CVE-2025-58049 | 7.5 | Aug 28 | XWiki PDF export jobs store sensitive cookies unencrypted in job statuses Affected: >= 14.4.2, < 16.4.8; >= 16.5.0-rc-1, < 16.10.7; >= 17.0.0-rc-1, < 17.4.0-rc-1 |
| CVE-2025-49584 | 7.5 | Jun 13 | XWiki makes title of inaccessible pages available through the class property values REST API Affected: >= 10.9, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-29924 | 7.5 | Mar 19 | XWiki uses the wrong wiki reference in AuthorizationManager Affected: >= 6.1-rc-1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1 |
| CVE-2023-50719 | 7.5 | Dec 15 | XWiki Platform Solr search discloses password hashes of all users Affected: >= 7.2-milestone-2, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 |
| CVE-2023-48241 | 7.5 | Nov 20 | XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service Affected: >= 6.3-milestone-2, < 14.10.15; >= 15.0-rc-1, < 15.5.1 |
| CVE-2023-35151 | 7.5 | Jun 23 | XWiki Platform may show email addresses in clear in REST results Affected: >= 7.3-milestone-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.1 |
| CVE-2023-34467 | 7.5 | Jun 23 | XWiki Platform may retrieve email addresses of all users Affected: >= 3.5-milestone-1, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-29517 | 7.5 | Apr 18 | Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-29208 | 7.5 | Apr 15 | Data leak through deleted documents Affected: >= 1.2-milestone-1, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-26470 | 7.5 | Mar 2 | In XWiki Platform, saving a document with a large object number leads to persistent OOM errors Affected: < 14.0-rc-1 |
| CVE-2023-26476 | 7.5 | Mar 2 | Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor Affected: >= 3.2-m3, < 13.4.4; >= 13.5.0, < 13.10.9; >= 14.0.0, < 14.7-rc-1 |
| CVE-2022-41936 | 7.5 | Nov 22 | Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server Affected: >= 8.1, < 13.10.8; >= 14.0.0, < 14.4.3; >= 14.5.0, < 14.6 |
| CVE-2022-36092 | 7.5 | Sep 8 | XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action Affected: < 13.10.4; >= 14.0, < 14.2 |
| CVE-2022-36091 | 7.5 | Sep 8 | XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor Affected: >= 1.3, < 13.10.4; >= 14.0, < 14.2 |
| CVE-2022-41927 | 7.4 | Nov 23 | XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags Affected: >= 3.2-milestone-2, < 13.10.7; >= 14.0.0, < 14.4.1 |
| CVE-2023-29507 | 7.2 | Apr 16 | org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors Affected: >= 14.5, < 14.10; >= 14.4.1, < 14.4.7 |
| CVE-2026-53966 | 7.1 | Sep 15 | XWiki Platform: Privilege escalation from edit to script right through Live Data editing Affected: >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0-rc-1 |
| CVE-2022-36093 | 7.1 | Sep 8 | XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard Affected: >= 8.0-rc-1, < 13.10.5; >= 14.0, < 14.3-rc-1 |
| CVE-2025-54125 | 6.5 | Aug 5 | XWiki Platform: Password and email exposure in xml.vm fields Affected: >= 1.1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.5; >= 17.0.0-rc-1, < 17.2.0-rc-1 |
| CVE-2025-54124 | 6.5 | Aug 5 | XWiki Platform: Any user with editing rights can access password properties through Database List Properties Affected: >= 9.8-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.5; >= 17.0.0-rc-1, < 17.2.0-rc-1 |
| CVE-2024-46978 | 6.5 | Sep 18 | Missing checks for notification filter preferences editions in XWiki Platform Affected: >= 13.2-rc-1, < 14.10.21; >= 15.0.0, < 15.5.5; >= 15.6.0, < 15.10.1 |
| CVE-2024-21651 | 6.5 | Jan 8 | XWiki Denial of Service attack through attachments Affected: >= 14.10, < 14.10.18; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1 |
| CVE-2023-37911 | 6.5 | Oct 25 | org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents Affected: >= 9.4-rc-1, < 14.10.8; >= 15.0-rc-1, < 15.3-rc-1 |
| CVE-2023-29520 | 6.5 | Apr 18 | Page render failure due to broken translations in xwiki-platform Affected: < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.1 |
| CVE-2023-26473 | 6.5 | Mar 2 | XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm Affected: >= 1.3-rc-1, < 13.10.11; >= 14.0, < 14.4.7; >= 14.5, < 14.10 |
| CVE-2023-26479 | 6.5 | Mar 2 | org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions Affected: >= 6.0, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9-rc-1 |
| CVE-2022-41933 | 6.5 | Nov 23 | Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default Affected: >= 13.1RC1, < 13.10.8; >= 14.0.0, < 14.4.3 |
| CVE-2022-31167 | 6.5 | Sep 7 | XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference Affected: >= 5.0, < 12.10.11; >= 13.0, < 13.4.6; >= 13.10, < 13.10.1 |
| CVE-2023-50732 | 6.3 | Dec 21 | Velocity execution without script right through tree macro Affected: >= 8.3-rc-1, < 14.10.7; >= 15.0-rc-1, < 15.2-rc-1 |
| CVE-2023-41046 | 6.3 | Sep 1 | Velocity execution without script rights in Xwiki platform Affected: >= 7.2, < 14.10.10; >= 15.0-rc-1, < 15.4-rc-1 |