XW
Product
Xwiki
On CISA KEVExploited in the wild
248
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 32High 119Medium 88Low 3
Watch
Add Xwiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24893 In wildKEV | 9.8 | Feb 20 | Remote code execution as guest via SolrSearchMacros request in xwiki Affected: 5.4 before 15.10.11; 16.0.0 before 16.4.1; 5.3; 5.3; 5.3 |
| CVE-2023-27479 | 9.9 | Mar 7 | Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui Affected: after 6.3 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10; 6.3; 6.3; 6.3 |
| CVE-2026-33229 | 9.8 | Apr 8 | XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API Affected: 17.0.0 before 17.4.8; 17.5.0 before 17.10.1 |
| CVE-2025-54385 | 9.8 | Jul 26 | XWiki Platform's searchDocuments API allows for SQL injection Affected: before 16.10.6; 17.0.0 through 17.2.2 |
| CVE-2025-32429 | 9.8 | Jul 24 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter Affected: 9.4 before 16.10.6; 17.0.0 through 17.2.2 |
| CVE-2024-56158 | 9.8 | Jun 12 | XWiki allows SQL injection in query endpoint of REST API with Oracle Affected: 1.0 before 15.10.16; 16.0.0 before 16.4.7; 16.5.0 before 16.10.2 |
| CVE-2025-46557 | 9.8 | Apr 30 | Any user with view access to the XWiki space can change the authenticator Affected: 15.3 before 15.10.14; 16.0.0 before 16.4.6; 16.5.0 through 16.9.0 |
| CVE-2025-32969 | 9.8 | Apr 23 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API Affected: 1.8 before 15.10.16; 16.0.0 before 16.4.6; 16.5.0 before 16.10.1 |
| CVE-2025-29926 | 9.8 | Mar 19 | The WikiManager REST API allows any user to create wikis Affected: 5.4.1 before 15.10.15; 16.0.0 before 16.4.6; 16.5.0 before 16.10.0; 5.4; 5.4 |
| CVE-2024-55663 | 9.8 | Dec 12 | XWiki Platform has an SQL injection in getdocuments.vm with sort parameter Affected: 6.4 before 13.10.5; 14.0 before 14.3; 6.3; 6.3; 6.3 |
| CVE-2024-31996 | 9.8 | Apr 10 | XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution Affected: 3.0.1 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2024-31982 | 9.8 | Apr 10 | XWiki Platform: Remote code execution as guest via DatabaseSearch Affected: 2.4 before 14.10.20; 15.0 before 15.5.4; 15.6 before 15.10 |
| CVE-2024-21650 | 9.8 | Jan 8 | XWiki Remote Code Execution vulnerability via user registration Affected: before 14.10.17; 15.0 before 15.5.3; 15.6 through 15.7 |
| CVE-2023-46731 | 9.8 | Nov 6 | Remote code execution through the section parameter in Administration as guest in XWiki Platform Affected: before 14.10.14; 15.0 before 15.5.1 |
| CVE-2023-26477 | 9.8 | Mar 2 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability Affected: 6.2.4 before 13.10.10; 14.0 before 14.4.6; 14.5 before 14.9 |
| CVE-2022-29161 | 9.8 | May 5 | Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform Affected: before 13.10.6; 14.0 before 14.3.1 |
| CVE-2023-45136 | 9.6 | Oct 25 | XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled Affected: 12.0 before 14.10.12; 15.0 before 15.5; 15.5 |
| CVE-2023-37277 | 9.6 | Jul 10 | XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API Affected: 1.8 before 14.10.8; 15.0 before 15.2 |
| CVE-2023-31126 | 9.6 | May 9 | Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml Affected: 14.6 before 14.10.4 |
| CVE-2025-55747 | 9.1 | Sep 3 | XWiki Platform's configuration files can be accessed through the webjars API Affected: 6.2 before 16.10.7; 17.0.0 through 17.3.0; 6.1; 6.1 |
| CVE-2025-53835 | 9.0 | Jul 14 | XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax Affected: 5.4.5 before 14.10 |
| CVE-2025-46558 | 9.0 | Apr 30 | org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content Affected: 8.2 before 8.9 |
| CVE-2025-32973 | 9.0 | Apr 30 | org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right Affected: 15.9 before 15.10.12; 16.0.0 before 16.4.3; 16.5.0 before 16.8.0 |
| CVE-2025-32974 | 9.0 | Apr 30 | org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type Affected: 15.9 before 15.10.8; 16.0.0 before 16.2.0 |
| CVE-2023-45134 | 9.0 | Oct 25 | XWiki Platform XSS vulnerability from account in the create page form via template provider Affected: 3.1.1 before 13.4; 14.10 before 14.10.2; 2.4; 2.5; 3.0; 3.0; +8 more |
| CVE-2023-32071 | 9.0 | May 9 | XWiki Platform vulnerable to RXSS via editor parameter - importinline template Affected: 2.3 before 14.4.8; 14.5.0 before 14.10.4; 2.2 |
| CVE-2023-29207 | 9.0 | Apr 15 | Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro Affected: 1.9 before 13.10.10; 14.0 before 14.4.6; 14.5 before 14.9; 1.9 |
| CVE-2023-29202 | 9.0 | Apr 15 | org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability Affected: after 1.8 through 14.5; 1.8; 1.8; 1.8 |
| CVE-2023-29201 | 9.0 | Apr 15 | org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability Affected: 5.0 through 14.5 |
| CVE-2022-36098 | 9.0 | Sep 8 | XWiki Platform Mentions UI vulnerable to Cross-site Scripting Affected: 12.5 before 13.10.6; 14.0 before 14.4 |
| CVE-2022-36096 | 9.0 | Sep 8 | XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list Affected: 2.3 before 13.10.6; 14.0 before 14.3; 2.2 |
| CVE-2022-36094 | 9.0 | Sep 8 | XWiki Platform Web Parent POM vulnerable to XSS in the attachment history Affected: 1.0 before 13.10.6; 14.0 before 14.3 |
| CVE-2025-51991 | 8.8 | Aug 20 | XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global… Affected: through 17.3.0 |
| CVE-2025-53836 | 8.8 | Jul 14 | XWiki Rendering is vulnerable to RCE attacks when processing nested macros Affected: 4.3 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10; 4.2; 4.2; 4.2; +1 more |
| CVE-2025-49586 | 8.8 | Jun 13 | XWiki allows remote code execution through preview of XClass changes in AWM editor Affected: 7.3 before 16.4.7; 16.5.0 before 16.10.3; 7.2; 7.2; 17.0.0 |
| CVE-2025-49581 | 8.8 | Jun 13 | XWiki allows remote code execution through default value of wiki macro wiki-type parameters Affected: 11.10.11 before 12.0; 12.6.3 before 12.7; 12.8 before 16.4.7; 16.5.0 before 16.10.3; 17.0.0 |
| CVE-2025-48063 | 8.8 | May 21 | XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right Affected: 16.10.0 before 16.10.4; 17.0.0; 17.0.0 |
| CVE-2025-32968 | 8.8 | Apr 23 | org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API Affected: 1.6 before 15.10.16; 16.0.0 before 16.4.6; 16.5.0 through 16.10.1 |
| CVE-2024-55879 | 8.8 | Dec 12 | XWiki allows RCE from script right in configurable sections Affected: 2.3 before 15.10.9; 16.0.0 before 16.3.0 |
| CVE-2024-55877 | 8.8 | Dec 12 | XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Affected: 9.7 before 15.10.11; 16.0.0 before 16.4.1; 16.5.0 |
| CVE-2024-55662 | 8.8 | Dec 12 | XWiki allows remote code execution through the extension sheet Affected: 3.3 before 15.10.9; 16.0.0 before 16.3.0 |
| CVE-2024-37901 | 8.8 | Jul 31 | XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Affected: 9.2 before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.2 |
| CVE-2024-31997 | 8.8 | Apr 10 | XWiki Platform remote code execution from account through UIExtension parameters Affected: before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2024-31988 | 8.8 | Apr 10 | XWiki Platform CSRF remote code execution through the realtime HTML Converter API Affected: 13.9 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2024-31987 | 8.8 | Apr 10 | XWiki Platform remote code execution from account via custom skins support Affected: 6.4 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.10 |
| CVE-2024-31986 | 8.8 | Apr 10 | XWiki Platform CSRF remote code execution through scheduler job's document reference Affected: 3.1.1 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2024-31984 | 8.8 | Apr 10 | XWiki Platform: Remote code execution through space title and Solr space facet Affected: 7.3 before 14.10.20; 15.0 before 15.5.4; 15.6 before 15.10; 7.2; 7.2 |
| CVE-2024-31983 | 8.8 | Apr 10 | XWiki Platform: Remote code execution from edit in multilingual wikis via translations Affected: 4.3.1 before 14.10.20; 15.0 before 15.5.4; 15.6 before 15.10; 4.3; 4.3; 4.3 |
| CVE-2024-31981 | 8.8 | Apr 10 | XWiki Platform: Privilege escalation (PR) from user registration through PDFClass Affected: 3.0.1 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2024-31465 | 8.8 | Apr 10 | XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet Affected: 5.3 before 14.10.20; 15.0 before 15.5.4; 15.6 before 15.10; 5.2; 5.2; 5.2 |