Login Request a demo
XW
Product
xwiki-platform
by xwiki · last CVE Sep 15, 2026
On CISA KEVExploited in the wild
180
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities180In the news1Timeline
Severity mix
Critical 25High 94Medium 59Low 2
Severity
All severities180Critical25High94Medium59Low2
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add xwiki-platform to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-24893
In wildKEV
9.8
100%
Feb 20
Remote code execution as guest via SolrSearchMacros request in xwiki
Affected: >= 5.3-milestone-2, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1
CVE-2023-27479
9.9
1%
Mar 7
Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
Affected: >= 6.3-milestone-2, < 13.10.11; >= 14.0.0, < 14.4.7; >= 14.5.0, < 14.10-rc-1
CVE-2026-33229
9.8
1%
Apr 8
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
Affected: >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1
CVE-2025-54385
9.8
1%
Jul 26
XWiki Platform's searchDocuments API allows for SQL injection
Affected: < 16.10.6; >= 17.0.0-rc1, < 17.3.0-rc-1
CVE-2025-32429
9.8
85%
Jul 24
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
Affected: >= 9.4-rc-1, < 16.10.6; >= 17.0.0-rc-1, < 17.3.0-rc-1
CVE-2024-56158
9.8
1%
Jun 12
XWiki allows SQL injection in query endpoint of REST API with Oracle
Affected: >= 1.0, < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2
CVE-2025-46557
9.8
1%
Apr 30
Any user with view access to the XWiki space can change the authenticator
Affected: >= 15.3-rc-1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1
CVE-2025-32969
9.8
80%
Apr 23
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
Affected: >= 1.8, < 15.10.16; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.1
CVE-2025-29926
9.8
1%
Mar 19
The WikiManager REST API allows any user to create wikis
Affected: >= 5.4-rc-1, < 15.10.15; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0
CVE-2024-55663
9.8
1%
Dec 12
XWiki Platform has an SQL injection in getdocuments.vm with sort parameter
Affected: >= 6.3-milestone-2, < 13.10.5; >= 14.0-rc-1, < 14.3-rc-1
CVE-2024-31982
9.8
35%
Apr 10
XWiki Platform: Remote code execution as guest via DatabaseSearch
Affected: >= 2.4-milestone-1, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
CVE-2024-21650
9.8
93%
Jan 8
XWiki Remote Code Execution vulnerability via user registration
Affected: >= 2.2, < 14.10.17; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1
CVE-2023-46731
9.8
89%
Nov 6
Remote code execution through the section parameter in Administration as guest in XWiki Platform
Affected: org.xwiki.platform:xwiki-platform-administration : < 14.10.14; org.xwiki.platform:xwiki-platform-administration-ui: < 14.10.14; org.xwiki.platform:xwiki-platform-administration-ui: >= 15.0-rc-1, < 15.5.1
CVE-2023-26477
9.8
75%
Mar 2
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Affected: >= 6.2.4, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9-rc-1
CVE-2023-45136
9.6
5%
Oct 25
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
Affected: >= 12.0-rc-1, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1
CVE-2023-37277
9.6
1%
Jul 10
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
Affected: >= 1.8, < 14.10.8; >= 15.0-rc-1, < 15.2
CVE-2026-33137
9.3
1%
May 20
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Affected: >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1
CVE-2025-52472
9.3
2%
Oct 6
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
Affected: >= 4.3-milestone-1, < 16.10.9; >= 17.0.0-rc-1, < 17.4.2
CVE-2025-55747
9.1
2%
Sep 3
XWiki Platform's configuration files can be accessed through the webjars API
Affected: >= 6.1-milestone-2, < 16.10.7
CVE-2025-32973
9.0
0%
Apr 30
org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
Affected: >= 15.9-rc-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.8.0-rc-1
CVE-2025-32974
9.0
0%
Apr 30
org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
Affected: >= 15.9-rc-1, < 15.10.8; >= 16.0.0-rc-1, < 16.2.0
CVE-2023-45134
9.0
2%
Oct 25
XWiki Platform XSS vulnerability from account in the create page form via template provider
Affected: >= 3.1-milestone-1, < 13.4-rc-1; >= 2.4-milestone-2, < 3.1-milestone-1; >= 14.0-rc-1, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1
CVE-2023-32071
9.0
70%
May 9
XWiki Platform vulnerable to RXSS via editor parameter - importinline template
Affected: >= 2.2-milestone-1, < 14.4.8; >= 14.5, < 14.10.4
CVE-2023-29207
9.0
1%
Apr 15
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
Affected: >= 1.9-milestone-2, < 13.10.10; >= 14.0-rc-1, < 14.4.6; >= 14.5, < 14.9
CVE-2023-29202
9.0
1%
Apr 15
org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability
Affected: >= 1.8, <= 3.0.1; < 14.6-rc-1
Showing 25