XW
Product
Xwiki
On CISA KEVExploited in the wild
248
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 32High 119Medium 88Low 3
Watch
Add Xwiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-15171 | 6.6 | Sep 10 | In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools… Affected: before 11.10.5; 12.0.0 before 12.2.1 |
| CVE-2025-54125 | 6.5 | Aug 5 | XWiki Platform: Password and email exposure in xml.vm fields Affected: 1.1 before 16.4.7; 16.5.0 before 16.10.5; 17.0.0 through 17.1.0 |
| CVE-2025-54124 | 6.5 | Aug 5 | XWiki Platform: Any user with editing rights can access password properties through Database List Properties Affected: 9.8 before 16.4.7; 16.5.0 before 16.10.5; 17.0.0 through 17.1.0 |
| CVE-2024-46978 | 6.5 | Sep 18 | Missing checks for notification filter preferences editions in XWiki Platform Affected: 13.2 before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.1 |
| CVE-2024-21651 | 6.5 | Jan 8 | XWiki Denial of Service attack through attachments Affected: 14.10 before 14.10.18; 15.5 before 15.5.3; 15.6 before 15.8 |
| CVE-2023-37911 | 6.5 | Oct 25 | org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents Affected: after 9.4 through 14.10.8; 9.4 |
| CVE-2023-29520 | 6.5 | Apr 18 | Page render failure due to broken translations in xwiki-platform Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.1 |
| CVE-2023-26473 | 6.5 | Mar 2 | XWiki Platform is a generic wiki platform Affected: 1.3 before 13.10.11; 14.0 before 14.4.7; 14.5 before 14.10; 1.3 |
| CVE-2023-26479 | 6.5 | Mar 2 | XWiki Platform is a generic wiki platform Affected: 6.0 before 13.10.10; 14.0 before 14.4.6; 14.5 before 14.9 |
| CVE-2022-41933 | 6.5 | Nov 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: after 13.1 before 13.10.8; 14.0.0 before 14.4.3; 13.1 |
| CVE-2022-31167 | 6.5 | Sep 7 | XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform Affected: 5.0 before 12.10.11; 13.0 before 13.4.6; 13.5 before 13.10.1 |
| CVE-2022-23617 | 6.5 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: through 12.10.5; 13.0; 13.1 |
| CVE-2021-32732 | 6.5 | Feb 4 | ### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request… Affected: before 12.10.5; 13.0; 13.1 |
| CVE-2023-50732 | 6.3 | Dec 21 | Velocity execution without script right through tree macro Affected: 8.3 before 14.10.7; 15.0 before 15.2 |
| CVE-2023-41046 | 6.3 | Sep 1 | Velocity execution without script rights in Xwiki platform Affected: 7.2 before 14.10.10; 15.0 before 15.4 |
| CVE-2026-40105 | 6.1 | Apr 15 | XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality Affected: 10.4 before 16.10.16; 17.0.0 before 17.4.8; 17.5.0 before 17.10.1 |
| CVE-2026-26000 | 6.1 | Feb 12 | XWiki Platform affected by click-jacking through CSS injection in comments Affected: before 16.10.13; 17.0.0 before 17.4.6; 17.5.0 before 17.9.0 |
| CVE-2026-24128 | 6.1 | Jan 23 | XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages Affected: 7.0.1 before 16.10.12; 17.0.1 before 17.4.5; 17.6.0 before 17.8.0; 7.0; 7.0; 17.0.0 |
| CVE-2025-66472 | 6.1 | Dec 10 | XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication Affected: 6.2 before 16.10.10; 17.0.0 before 17.4.2 |
| CVE-2025-32430 | 6.1 | Aug 5 | XWiki Platform contains Reflected XSS vulnerability in two templates Affected: 4.3 before 16.4.8; 16.5.0 before 16.10.6; 17.0.0 through 17.2.2; 4.2; 16.5.0 |
| CVE-2025-32970 | 6.1 | Apr 30 | org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability Affected: 13.5 before 15.10.13; 16.0.0 before 16.4.4; 16.5.0 before 16.8.0; 16.8.0 |
| CVE-2023-46732 | 6.1 | Nov 6 | Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform Affected: 9.7 before 14.10.14; 15.0 before 15.5.1 |
| CVE-2023-35162 | 6.1 | Jun 23 | XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template Affected: 6.2 before 14.10.5; 6.1; 6.1; 6.1; 6.1 |
| CVE-2023-35161 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page Affected: 6.2.1 before 14.10.5; 6.2; 6.2 |
| CVE-2023-35160 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template Affected: 3.0 before 14.10.5; 2.5; 15.0 |
| CVE-2023-35159 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template Affected: 3.5 before 14.10.5; 3.4; 3.5; 15.0 |
| CVE-2023-35158 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template Affected: 9.4 before 14.10.5; 9.4; 9.4; 15.0 |
| CVE-2023-35156 | 6.1 | Jun 23 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template Affected: 6.0.1 before 14.10.6; 6.0; 6.0; 15.0 |
| CVE-2023-35155 | 6.1 | Jun 23 | XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email Affected: before 14.4.8; 14.10 before 14.10.4 |
| CVE-2023-32068 | 6.1 | May 15 | URL Redirection to Untrusted Site in XWiki Affected: before 14.10.4; 15.0 |
| CVE-2023-32070 | 6.1 | May 10 | Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers Affected: through 14.5 |
| CVE-2023-29506 | 6.1 | Apr 16 | org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints Affected: 13.10.8 before 13.10.11; 14.4.3 before 14.4.7; 14.6; 14.10 |
| CVE-2023-29204 | 6.1 | Apr 15 | URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore Affected: 6.0 before 13.10.10; 14.4.0 before 14.4.4; 14.5 through 14.7; 6.0 |
| CVE-2022-36097 | 6.1 | Sep 8 | XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform Affected: 14.0 before 14.3 |
| CVE-2022-29258 | 6.1 | May 31 | XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream Affected: 5.4.4 before 12.10.11; 13.0 before 13.4.7; 13.5 before 13.10.3 |
| CVE-2022-29252 | 6.1 | May 25 | XWiki Platform Wiki UI Main Wiki is a package for managing subwikis Affected: 5.4 before 12.10.11; 13.0 before 13.4.7; 13.5 before 13.10.3; 5.3 |
| CVE-2022-29251 | 6.1 | May 25 | XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin Affected: 6.2.4 before 12.10.11; 13.0 before 13.4.7; 13.5 before 13.10.3 |
| CVE-2022-23622 | 6.1 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: through 12.10.10; 13.0 through 13.4.6; 13.10; 13.10.1; 13.10.2; 14.0 |
| CVE-2022-23618 | 6.1 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: through 12.10.6; 13.0 through 13.3 |
| CVE-2021-29459 | 6.1 | Apr 20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 12.6.3; 12.6.4 before 12.8 |
| CVE-2021-32730 | 5.7 | Jul 1 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 12.10.5; 13.0; 13.1; 13.1 |
| CVE-2024-55876 | 5.4 | Dec 12 | XWiki's scheduler in subwiki allows scheduling operations for any main wiki user Affected: 1.2.1 before 15.10.9; 16.0.0 before 16.3.0; 1.2; 1.2; 1.2; 1.2; +1 more |
| CVE-2024-43400 | 5.4 | Aug 19 | XWiki Platform allows XSS through XClass name in string properties Affected: before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.6 |
| CVE-2024-41947 | 5.4 | Jul 31 | XWiki Platform XSS through conflict resolution Affected: 11.8 before 15.10.8; 16.0 before 16.3.0 |
| CVE-2024-31985 | 5.4 | Apr 10 | XWiki Platform CSRF in the job scheduler Affected: 3.1.1 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2023-45137 | 5.4 | Oct 25 | XWiki Platform XSS with edit right in the create document form for existing pages Affected: 3.1.1 before 13.4; 14.0 before 14.10.12; 15.0 before 15.5; 3.1; 3.1 |
| CVE-2023-40176 | 5.4 | Aug 23 | SXSS in the user profile via the timezone displayer Affected: 4.1.1 before 14.10.5; 4.1; 15.0; 15.0 |
| CVE-2023-36477 | 5.4 | Jun 30 | Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform Affected: 14.6 before 14.10.6; 15.0; 15.0 |
| CVE-2023-35153 | 5.4 | Jun 23 | XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters Affected: 5.4.4 before 14.4.8; 14.10 before 14.10.4; 15.0 |
| CVE-2023-34464 | 5.4 | Jun 23 | XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template Affected: 2.2.1 before 14.4.8; 14.10 before 14.10.5; 15.0 |