XW
Product
Xwiki
On CISA KEVExploited in the wild
248
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 32High 119Medium 88Low 3
Watch
Add Xwiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-29515 | 5.4 | Apr 18 | Cross-site scripting (XSS) in xwiki-platform Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.1 |
| CVE-2023-29508 | 5.4 | Apr 16 | org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29206 | 5.4 | Apr 15 | org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins Affected: after 3.0 through 14.8; 3.0; 3.0; 3.0; 3.0 |
| CVE-2023-29205 | 5.4 | Apr 15 | org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro Affected: through 14.7 |
| CVE-2023-26056 | 5.4 | Mar 2 | XWiki Platform allows macro execution as any user without programming rights through the context macro Affected: 3.1 before 13.10.10; 14.0 before 14.4.5; 14.5 before 14.8; 3.0; 3.0; 3.0 |
| CVE-2023-26480 | 5.4 | Mar 2 | XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data Affected: 12.10 before 13.10.10; 14.0 before 14.4.7; 14.5 before 14.9; 14.9 |
| CVE-2022-23620 | 5.4 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: through 13.6 |
| CVE-2022-23615 | 5.4 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 1.0 before 13.0 |
| CVE-2021-43841 | 5.4 | Feb 4 | XWiki is a generic wiki platform offering runtime services for applications built on top of it Affected: 1.0 before 12.10.6; 13.0 through 13.2 |
| CVE-2021-32729 | 5.4 | Jul 1 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 11.6.1 before 12.6.8; 12.7 before 12.10.4 |
| CVE-2021-21379 | 5.4 | Mar 12 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 11.4 before 11.10.11; 12.0 before 12.6.3; 12.7 through 12.7.1 |
| CVE-2021-3137 | 5.4 | Jan 20 | XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section Affected: 12.10.2 |
| CVE-2018-16277 | 5.4 | Sep 28 | The Image Import function in XWiki through 10.7 has XSS Affected: through 10.7 |
| CVE-2025-46554 | 5.3 | Apr 30 | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API Affected: 1.8.1 before 14.10.22; 15.0 before 15.10.12; 16.0.0 before 16.4.3; 16.5.0 before 16.7.0 |
| CVE-2025-32972 | 5.3 | Apr 30 | The lesscss script service allows cache clearing without programming right Affected: 6.2 before 15.10.12; 16.0.0 before 16.4.3; 16.5.0 before 16.8.0; 6.1; 6.1; 6.1; +1 more |
| CVE-2025-29925 | 5.3 | Mar 19 | XWiki allows unregistered users to access private pages information through REST endpoint Affected: 1.9 before 15.10.14; 16.0.0 before 16.4.6; 16.5.0 through 16.10.0 |
| CVE-2024-46979 | 5.3 | Sep 18 | Data leak of notification filters of users in XWiki Platform Affected: 13.2 before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.1 |
| CVE-2024-45591 | 5.3 | Sep 10 | XWiki Platform document history including authors of any page exposed to unauthorized actors Affected: 1.8 before 15.10.9; 16.0.0 before 16.3.0 |
| CVE-2023-50720 | 5.3 | Dec 15 | XWiki Platform Solr search discloses email addresses of users Affected: before 14.10.5; 15.0 before 15.5.2; 15.6; 15.6; 15.7 |
| CVE-2023-29203 | 5.3 | Apr 15 | Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm Affected: 13.9 before 13.10.8; 14.4.0 before 14.4.3; 14.5 through 14.6; 13.9 |
| CVE-2022-41932 | 5.3 | Nov 23 | Creation of new database tables through login form on PostgreSQL Affected: before 13.10.8; 14.0.0 before 14.4.2; 14.5.0 before 14.6; 14.4.3; 14.4.4 |
| CVE-2022-24820 | 5.3 | Apr 8 | Unauthenticated user can list hidden document from multiple velocity templates Affected: before 12.10.11; 13.4.0 before 13.4.4; 13.9 |
| CVE-2022-24819 | 5.3 | Apr 8 | Unauthenticated user can retrieve the list of users through uorgsuggest.vm Affected: before 12.10.11; 13.0.0 before 13.4.4; 13.9 |
| CVE-2021-32731 | 5.3 | Jul 1 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 13.1; 13.1 |
| CVE-2024-31464 | 4.9 | Apr 10 | XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted Affected: 5.0 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2022-41929 | 4.9 | Nov 23 | Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore Affected: after 11.7 before 13.10.7; after 14.0.0 before 14.4.2; 11.7; 14.4.3; 14.4.4 |
| CVE-2022-23621 | 4.9 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 12.10.9; 13.4 before 13.4.3; 13.4.4 through 13.7 |
| CVE-2025-51990 | 4.8 | Aug 20 | XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section… Affected: through 17.3.0 |
| CVE-2023-35157 | 4.8 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via delattachment action Affected: before 14.10.6; 15.0 |
| CVE-2024-37900 | 4.6 | Jul 31 | XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader Affected: after 4.2 before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.6; 4.2; 4.2; 16.0.0 |
| CVE-2025-32783 | 4.3 | Apr 16 | XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki Affected: 5.0 through 16.7.1 |
| CVE-2024-37898 | 4.3 | Jul 31 | XWiki Platform vulnerable to document deletion and overwrite from edit Affected: 13.10.4 before 14.0; 14.2 before 14.10.21; after 15.0 before 15.5.5; 15.6 before 15.10.6; 15.0 |
| CVE-2024-38369 | 4.3 | Jun 24 | XWiki programming rights may be inherited by inclusion Affected: 1.5 before 15.0 |
| CVE-2023-38509 | 4.3 | Jul 27 | XWiki Platform's obfuscated email addresses should not be sorted Affected: 3.5 before 14.10.9 |
| CVE-2023-34466 | 4.3 | Jun 23 | XWiki Platform's tags on non-viewable pages can be revealed to users Affected: 5.0.1 before 14.4.8; 14.10 before 14.10.4; 5.0 |
| CVE-2023-29513 | 4.3 | Apr 18 | Users can be created even when registration is disabled without validation via the template macro in xwiki-platform Affected: before 14.10.1 |
| CVE-2022-41935 | 4.3 | Nov 23 | Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui Affected: 12.10.11 before 13.10.8; 14.0.0 before 14.4.3; 14.4.4; 14.4.5 |
| CVE-2022-36095 | 4.3 | Sep 8 | XWiki Cross-Site Request Forgery (CSRF) for actions on tags Affected: 2.3 before 13.10.6; 14.0 before 14.3; 2.0 |