XW
Product
xwiki-platform
On CISA KEVExploited in the wild
222
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 29High 111Medium 79Low 3
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45591 | 5.3 | Sep 10 | XWiki Platform document history including authors of any page exposed to unauthorized actors Affected: >= 1.8.0, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0-rc-1 |
| CVE-2023-50720 | 5.3 | Dec 15 | XWiki Platform Solr search discloses email addresses of users Affected: < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 |
| CVE-2023-29203 | 5.3 | Apr 15 | Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm Affected: >= 13.9-rc-1, < 13.10.8; >= 14.0-rc-1, < 14.4.3; >= 14.5, < 14.7-rc-1 |
| CVE-2022-41932 | 5.3 | Nov 23 | Creation of new database tables through login form on PostgreSQL Affected: < 13.10.8; >= 14.0.0, < 14.4.2; >= 14.5.0, < 14.6-rc-1 |
| CVE-2022-24820 | 5.3 | Apr 8 | Unauthenticated user can list hidden document from multiple velocity templates Affected: < 8.4.5, < 10.11.8, < 11.3.1, < 13.6-rc-1 |
| CVE-2022-24819 | 5.3 | Apr 8 | Unauthenticated user can retrieve the list of users through uorgsuggest.vm Affected: < 4.3 |
| CVE-2024-31464 | 4.9 | Apr 10 | XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted Affected: >= 5.0-rc-1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1 |
| CVE-2022-41929 | 4.9 | Nov 23 | Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore Affected: >= 11.7RC1, < 13.10.7; >= 14.0.0, < 14.4.2 |
| CVE-2022-23621 | 4.9 | Feb 9 | Missing authorization in xwiki-platform Affected: >= 13.6.0, < 13.7-rc-1; >= 13.0.0, < 13.4.3; < 12.10.9 |
| CVE-2023-35157 | 4.8 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via delattachment action Affected: >= 3.2-milestone-3, < 14.10.6; >= 15.0-rc-0, < 15.1-rc-1 |
| CVE-2024-37900 | 4.6 | Jul 31 | XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader Affected: >= 4.2-milestone-3, < 14.10.21; >= 15.0-rc-1, < 15.5.5; >= 15.6-rc-1, < 15.10.6; >= 16.0.0-rc-1, < 16.0.0 |
| CVE-2025-32783 | 4.3 | Apr 16 | XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki Affected: >= 5.0, <= 16.7.1 |
| CVE-2024-37898 | 4.3 | Jul 31 | XWiki Platform vulnerable to document deletion and overwrite from edit Affected: >= 13.10.4, < 14.0-rc-1; >= 14.2, < 14.10.21; >= 15.0, < 15.5.5; >= 15.6-rc-1, < 15.10.6 |
| CVE-2024-38369 | 4.3 | Jun 24 | XWiki programming rights may be inherited by inclusion Affected: >= 1.5-milestone-2, < 15.0-rc-1 |
| CVE-2023-38509 | 4.3 | Jul 27 | XWiki Platform's obfuscated email addresses should not be sorted Affected: >= 3.5-milestone-1, < 14.10.9; >= 15.0, < 15.3-rc-1 |
| CVE-2023-34466 | 4.3 | Jun 23 | XWiki Platform's tags on non-viewable pages can be revealed to users Affected: >= 5.0-milestone-1, < 14.4.8; >= 14.5, < 14.10.4 |
| CVE-2023-29513 | 4.3 | Apr 18 | Users can be created even when registration is disabled without validation via the template macro in xwiki-platform Affected: < 14.10.1 |
| CVE-2022-41935 | 4.3 | Nov 23 | Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui Affected: >= 12.10.11, < 13.10.8; >= 14.0.0, < 14.4.3 |
| CVE-2022-36095 | 4.3 | Sep 8 | XWiki Cross-Site Request Forgery (CSRF) for actions on tags Affected: >= 2.0-milestone-1, < 13.10.5; >= 14.0, < 14.3 |
| CVE-2025-32971 | 3.8 | Apr 30 | XWiki Solr script service doesn't take dropped programming right into account Affected: >= 4.5.1, < 15.10.13; >= 16.0.0-rc-1, < 16.4.4; >= 16.5.0-rc-1, < 16.8.0-rc-1 |
| CVE-2025-49583 | 3.5 | Jun 13 | XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right Affected: < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 |
| CVE-2022-29253 | 2.7 | May 25 | Path Traversal in XWiki Platform Affected: >= 8.3-rc-1, < 13.10.3 |