XW
Product
Xwiki
On CISA KEVExploited in the wild
248
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 32High 119Medium 88Low 3
Watch
Add Xwiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-21648 | 8.8 | Jan 8 | XWiki has no right protection on rollback action Affected: before 14.10.17; 15.0 before 15.5.3; 15.6 before 15.8 |
| CVE-2023-50723 | 8.8 | Dec 15 | XWiki Platform remote code execution/programming rights with configuration section from any user account Affected: 2.3 before 14.10.5; 15.0 before 15.5.2; 15.6; 15.6; 15.7 |
| CVE-2023-50722 | 8.8 | Dec 15 | XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass Affected: 2.3 before 14.10.5; 15.0 before 15.5.2; 15.6; 15.6; 15.7 |
| CVE-2023-50721 | 8.8 | Dec 15 | XWiki Platform RCE from account through SearchAdmin Affected: 4.5 before 14.10.5; 15.0 before 15.5.2; 15.6; 15.6; 15.7 |
| CVE-2023-48293 | 8.8 | Nov 20 | XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries Affected: before 4.5.1 |
| CVE-2023-48240 | 8.8 | Nov 20 | XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery Affected: 11.10.1 before 14.10.15; 15.0 before 15.5.1; 15.6 |
| CVE-2023-46243 | 8.8 | Nov 7 | Code execution via the edit action in XWiki platform Affected: 1.0 before 14.10.6; 15.0 before 15.2 |
| CVE-2023-46242 | 8.8 | Nov 7 | Code injection in XWiki Platform Affected: 1.0 before 14.10.7; 15.0 before 15.2 |
| CVE-2023-46244 | 8.8 | Nov 7 | Privilege escalation in Xwiki platform Affected: 3.3 before 14.10.7; 15.0 before 15.2; 3.2 |
| CVE-2023-37913 | 8.8 | Oct 25 | org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter Affected: 3.5 before 14.10.8; 15.0 before 15.3 |
| CVE-2023-37909 | 8.8 | Oct 25 | Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet Affected: 5.1 before 14.10.8 |
| CVE-2023-40573 | 8.8 | Aug 24 | XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution Affected: before 14.10.9; 15.0; 15.0; 15.1; 15.1; 15.2; +3 more |
| CVE-2023-40177 | 8.8 | Aug 23 | XWiki Platform privilege escalation (PR) from account through AWM content fields Affected: 4.3.1 before 14.10.5; 4.3; 15.0; 15.0 |
| CVE-2023-37914 | 8.8 | Aug 17 | Privilege escalation (PR)/RCE from account through Invitation subject/message Affected: 2.5 before 14.4.8; 14.5.0 before 14.10.6; 15.0 before 15.2 |
| CVE-2023-37462 | 8.8 | Jul 14 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui Affected: 7.0 before 14.4.8; 14.5 before 14.10.4 |
| CVE-2023-36468 | 8.8 | Jun 29 | Upgrading doesn't prevent exploiting vulnerable XWiki documents Affected: 2.0 before 14.10.7; 15.0; 15.0; 15.1; 15.1 |
| CVE-2023-36469 | 8.8 | Jun 29 | Code injection through NotificationRSSService in XWiki Platform Affected: 9.6 before 14.10.6; 15.0; 15.0; 15.1; 15.1 |
| CVE-2023-36470 | 8.8 | Jun 29 | Code injection in icon themes of XWiki Platform Affected: 6.2 before 14.10.6; 15.0; 15.0; 15.1; 15.1 |
| CVE-2023-35152 | 8.8 | Jun 23 | XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults Affected: 12.9 before 14.4.8; 14.10 before 14.10.6; 12.9; 15.0; 15.0 |
| CVE-2023-35166 | 8.8 | Jun 20 | Privilege escalation (PR) from account through TipsPanel Affected: 8.1 before 14.10.5 |
| CVE-2023-32069 | 8.8 | May 9 | XWiki Platform privilege escalation (PR)/RCE from account through class sheet Affected: 3.4 before 14.10.4; 3.3 |
| CVE-2023-29516 | 8.8 | Apr 18 | Code injection from view right on XWiki.AttachmentSelector in xwiki-platform Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.1 |
| CVE-2023-29514 | 8.8 | Apr 18 | Code injection in template provider administration in xwiki-platform Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.1 |
| CVE-2023-29512 | 8.8 | Apr 18 | Code injection in xwiki-platform-web-templates Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.1 |
| CVE-2023-29510 | 8.8 | Apr 18 | Code injection via unescaped translations in xwiki-platform Affected: before 14.10.2 |
| CVE-2023-29522 | 8.8 | Apr 18 | Code injection from view right on XWiki.ClassSheet in xwiki-platform Affected: before 14.4.8; 14.5 before 14.10.3 |
| CVE-2023-29521 | 8.8 | Apr 18 | Code injection from account/view through VFS Tree macro in xwiki-platform Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.2 |
| CVE-2023-29519 | 8.8 | Apr 18 | Code injection in org.xwiki.platform:xwiki-platform-attachment-ui Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.2 |
| CVE-2023-29518 | 8.8 | Apr 18 | Code injection from view right using Invitation.InvitationCommon in xwiki-platform Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.1 |
| CVE-2023-29523 | 8.8 | Apr 18 | Code injection in display method used in user profiles in xwiki-platform Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.2 |
| CVE-2023-29524 | 8.8 | Apr 18 | Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform Affected: before 14.10.3 |
| CVE-2023-29525 | 8.8 | Apr 18 | Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform Affected: before 14.4.8; 14.5 before 14.10.3 |
| CVE-2023-29526 | 8.8 | Apr 18 | Async and display macro allow displaying and interacting with any document in restricted mode Affected: 10.11.1 before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.3 |
| CVE-2023-29527 | 8.8 | Apr 18 | Code injection from account through AWM view sheet in xwiki platform Affected: 7.4.4 before 14.10.3 |
| CVE-2023-29213 | 8.8 | Apr 17 | org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability Affected: after 4.2 before 13.10.11; after 14.0 before 14.4.7; 14.5 before 14.10; 4.2; 4.2; 14.0; +1 more |
| CVE-2023-29511 | 8.8 | Apr 16 | xwiki-platform-administration-ui vulnerable to privilege escalation Affected: 1.7 before 13.10.11; after 14.0 before 14.4.8; 14.5 before 14.10.1; 14.0; 14.0 |
| CVE-2023-30537 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation Affected: 12.6.6 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10 |
| CVE-2023-29509 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29214 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29212 | 8.8 | Apr 16 | xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability Affected: 14.0 before 14.4.7; 14.10 |
| CVE-2023-29211 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29210 | 8.8 | Apr 15 | org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29209 | 8.8 | Apr 15 | org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability Affected: 10.9 before 13.10.11; 14.4.0 before 14.4.7; 14.8 before 14.10 |
| CVE-2023-26475 | 8.8 | Mar 2 | XWiki Platform is a generic wiki platform Affected: after 2.3 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10; 2.3 |
| CVE-2023-26474 | 8.8 | Mar 2 | XWiki Platform is a generic wiki platform Affected: 13.10 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10 |
| CVE-2023-26472 | 8.8 | Mar 2 | XWiki Platform is a generic wiki platform Affected: 6.2.1 before 13.10.10; 14.0 before 14.4.6; 14.5 before 14.9; 6.2; 6.2 |
| CVE-2023-26471 | 8.8 | Mar 2 | XWiki Platform is a generic wiki platform Affected: 11.6 before 13.10.10; 14.0 before 14.4.6; 14.5 before 14.9; 11.6 |
| CVE-2022-41934 | 8.8 | Nov 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 13.10.8; 14.0.0 before 14.4.3; 14.4.4; 14.4.5 |
| CVE-2022-41931 | 8.8 | Nov 23 | xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Affected: after 6.4 before 13.10.7; 14.0.0 before 14.4.2; 6.4; 6.4; 14.4.3; 14.4.4 |
| CVE-2022-41928 | 8.8 | Nov 23 | XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml Affected: after 5.0 before 13.10.7; 14.0.0 before 14.4.2; 5.0; 5.0; 14.4.3; 14.4.4 |