XW
Product
Xwiki
On CISA KEVExploited in the wild
248
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 32High 119Medium 88Low 3
Watch
Add Xwiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-29526 | 8.8 | Apr 18 | Async and display macro allow displaying and interacting with any document in restricted mode Affected: 10.11.1 before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.3 |
| CVE-2023-29527 | 8.8 | Apr 18 | Code injection from account through AWM view sheet in xwiki platform Affected: 7.4.4 before 14.10.3 |
| CVE-2023-29213 | 8.8 | Apr 17 | org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability Affected: after 4.2 before 13.10.11; after 14.0 before 14.4.7; 14.5 before 14.10; 4.2; 4.2; 14.0; +1 more |
| CVE-2023-29511 | 8.8 | Apr 16 | xwiki-platform-administration-ui vulnerable to privilege escalation Affected: 1.7 before 13.10.11; after 14.0 before 14.4.8; 14.5 before 14.10.1; 14.0; 14.0 |
| CVE-2023-30537 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation Affected: 12.6.6 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10 |
| CVE-2023-29509 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29214 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29212 | 8.8 | Apr 16 | xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability Affected: 14.0 before 14.4.7; 14.10 |
| CVE-2023-29211 | 8.8 | Apr 16 | org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29210 | 8.8 | Apr 15 | org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29209 | 8.8 | Apr 15 | org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability Affected: 10.9 before 13.10.11; 14.4.0 before 14.4.7; 14.8 before 14.10 |
| CVE-2023-26471 | 8.8 | Mar 2 | XWiki Platform users may execute anything with superadmin right through comments and async macro Affected: 11.6 before 13.10.10; 14.0 before 14.4.6; 14.5 before 14.9; 11.6 |
| CVE-2023-26472 | 8.8 | Mar 2 | XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile Affected: 6.2.1 before 13.10.10; 14.0 before 14.4.6; 14.5 before 14.9; 6.2; 6.2 |
| CVE-2023-26474 | 8.8 | Mar 2 | XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author Affected: 13.10 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10 |
| CVE-2023-26475 | 8.8 | Mar 2 | XWiki Platform vulnerable to Remote Code Execution in Annotations Affected: after 2.3 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10; 2.3 |
| CVE-2022-41934 | 8.8 | Nov 23 | Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui Affected: before 13.10.8; 14.0.0 before 14.4.3; 14.4.4; 14.4.5 |
| CVE-2022-41928 | 8.8 | Nov 23 | XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml Affected: after 5.0 before 13.10.7; 14.0.0 before 14.4.2; 5.0; 5.0; 14.4.3; 14.4.4 |
| CVE-2022-41931 | 8.8 | Nov 23 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui Affected: after 6.4 before 13.10.7; 14.0.0 before 14.4.2; 6.4; 6.4; 14.4.3; 14.4.4 |
| CVE-2022-36100 | 8.8 | Sep 8 | XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection Affected: 1.7 before 13.10.6; 14.0 before 14.4 |
| CVE-2022-36099 | 8.8 | Sep 8 | XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability Affected: 5.4 before 13.10.6; 14.0 before 14.4; 5.3 |
| CVE-2022-31166 | 8.8 | Sep 7 | XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups Affected: 11.3.7 before 13.10.4; 14.0 before 14.2 |
| CVE-2022-23616 | 8.8 | Feb 9 | Remote code execution in xwiki-platform Affected: 3.1.1 through 13.1; 3.1; 3.1; 3.1 |
| CVE-2021-32621 | 8.8 | May 28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 3.0.1 before 12.6.7; 12.10 before 12.10.3; 3.0; 3.0; 3.0 |
| CVE-2021-32620 | 8.8 | May 28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 11.6 before 11.10.13; 12.0 before 12.6.7; 12.7 before 12.10.2; 12.10.3 before 13.0 |
| CVE-2021-21380 | 8.8 | Mar 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 6.4.1 through 12.8; 6.4; 6.4; 6.4 |
| CVE-2020-15252 | 8.8 | Oct 16 | In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools… Affected: before 11.10.6; 12.0 before 12.5 |
| CVE-2020-11057 | 8.8 | May 12 | In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards Affected: 7.2 through 11.10.2 |
| CVE-2026-40104 | 8.2 | Apr 15 | XWiki's REST APIs can list all pages/spaces, leading to unavailability Affected: 1.8 before 16.10.16; 17.0.0 before 17.4.8; 17.5.0 before 17.10.1 |
| CVE-2022-41930 | 8.2 | Nov 23 | org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users Affected: 12.4 before 13.10.7; 14.0.0 before 14.4.2; 14.4.3; 14.4.4 |
| CVE-2023-37910 | 8.1 | Oct 25 | org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move Affected: 14.0 before 14.4.8; 14.5 before 14.10.4 |
| CVE-2023-34465 | 8.1 | Jun 23 | XWiki Platform's Mail.MailConfig can be edited by any user with edit rights Affected: 11.8.1 before 14.4.8; 14.10 before 14.10.6; 11.8; 15.0 |
| CVE-2023-26478 | 8.1 | Mar 2 | org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function Affected: 14.3 before 14.4.6; 14.5 before 14.9 |
| CVE-2022-41937 | 8.1 | Nov 22 | Missing Authorization in XWiki Platform Affected: before 13.10.8; 14.0 before 14.4.3; 14.5 |
| CVE-2022-36090 | 8.1 | Sep 8 | org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users Affected: 1.1 before 13.10.5 |
| CVE-2022-24821 | 8.1 | Apr 8 | Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx Affected: 12.0.0 before 12.10.11; 13.4.0 before 13.4.6; 13.10 |
| CVE-2025-49587 | 8.0 | Jun 13 | XWiki does not require right warnings for notification displayer objects Affected: 15.9 before 15.10.16; 16.0.0 before 16.4.7; 16.5.0 before 16.10.2 |
| CVE-2025-49585 | 8.0 | Jun 13 | XWiki does not require right warnings for XClass definitions Affected: before 15.10.16; 16.0.0 before 16.4.7; 16.5.0 before 16.10.2 |
| CVE-2025-49582 | 8.0 | Jun 13 | XWiki's required right warnings for macros are incomplete Affected: 15.9 before 16.4.7; 16.5.0 before 16.10.3; 17.0.0 |
| CVE-2025-49580 | 8.0 | Jun 13 | XWiki allows privilege escalation through link refactoring Affected: 7.4.5 before 16.4.7; 16.5.0 before 16.10.4; 17.0.0 before 17.1.0 |
| CVE-2025-23025 | 8.0 | Jan 14 | Privilege escalation (PR) through realtime WYSIWYG editing in XWiki Affected: 13.9 before 15.10.12; 16.0.0 before 16.4.1; 16.5.0; 16.5.0 |
| CVE-2024-43401 | 8.0 | Aug 19 | In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them Affected: through 15.9 |
| CVE-2024-37899 | 8.0 | Jun 20 | Disabling a user account changes its author, allowing RCE from user account in XWiki Affected: 13.10.3 before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.6; 13.4.7; 13.5; 16.0.0 |
| CVE-2023-45135 | 8.0 | Oct 25 | XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title Affected: 7.3 before 14.10.12; 15.0 before 15.5; 7.2; 7.2 |
| CVE-2023-40572 | 8.0 | Aug 24 | XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action Affected: before 14.10.9; 15.0; 15.0; 15.1; 15.1; 15.2; +3 more |
| CVE-2023-35150 | 8.0 | Jun 23 | XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application Affected: 2.5 before 14.4.8; 14.10 before 14.10.4; 2.4 |
| CVE-2023-27480 | 7.7 | Mar 7 | Data leak through a XAR import XXE attack in xwiki-platform-xar-model Affected: after 1.1 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10; 1.1; 1.1 |
| CVE-2025-66473 | 7.5 | Dec 10 | XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis Affected: before 16.10.11; 17.0.0 before 17.4.4; 17.5.0 through 17.6.0 |
| CVE-2025-55749 | 7.5 | Dec 1 | The XWiki Jetty package (XJetty) allows accessing any application file through URL Affected: 16.7.0 before 16.10.11; 17.0.0 before 17.4.4; 17.5.0 before 17.7.0 |
| CVE-2025-55748 | 7.5 | Sep 3 | XWiki Platform's configuration files can be accessed through jsx and sx endpoints Affected: 4.3 before 16.10.7; 17.0.0 through 17.3.0; 4.2; 4.2 |
| CVE-2025-58049 | 7.5 | Aug 28 | XWiki PDF export jobs store sensitive cookies unencrypted in job statuses Affected: 14.4.2 before 16.4.8; 16.5.0 before 16.10.7; 17.0.0 through 17.3.0 |