Login Request a demo
XW
Vendor
Xwiki
24 products with CVEs on record
367
CVEs
3
On KEV
0
New 30D
Products
XW
Xwiki
Xwiki
9.9
248 CVEs1 on KEV0 new
XW
xwiki-platform
xwiki
9.8
73 CVEs1 on KEV0 new
PL
Platform
XWiki
9.8
1 CVEs1 on KEV0 new
XW
xwiki-rendering
xwiki
9.9
7 CVEs0 on KEV0 new
CO
Commons
Xwiki
9.9
5 CVEs0 on KEV0 new
CR
Cryptpad
Xwiki
9.1
5 CVEs0 on KEV0 new
PM
Pro Macros
Xwiki
9.8
5 CVEs0 on KEV0 new
PV
Pdf Viewer Macro
Xwiki
9.0
3 CVEs0 on KEV0 new
CR
Change Request
Xwiki
9.6
2 CVEs0 on KEV0 new
CI
Ckeditor Integration
Xwiki
8.8
2 CVEs0 on KEV0 new
FC
Full Calendar Macro
Xwiki
10.0
2 CVEs0 on KEV0 new
XW
xwiki-commons
xwiki
9.8
2 CVEs0 on KEV0 new
AT
Admin Tools
Xwiki
8.8
1 CVEs0 on KEV0 new
AP
Application-collabora
Xwiki
4.3
1 CVEs0 on KEV0 new
AL
Application Licensing
Xwiki
5.3
1 CVEs0 on KEV0 new
BA
Blog Application
Xwiki
9.0
1 CVEs0 on KEV0 new
CM
Confluence Migrator
Xwiki
7.5
1 CVEs0 on KEV0 new
OI
Oauth Identity
Xwiki
9.6
1 CVEs0 on KEV0 new
OC
Openid Connect
Xwiki
7.5
1 CVEs0 on KEV0 new
OR
org.xwiki.platform:xwiki-platform-legacy-oldcore
xwiki
8.2
1 CVEs0 on KEV0 new
OR
org.xwiki.platform:xwiki-platform-oldcore
xwiki
8.2
1 CVEs0 on KEV0 new
RE
Rendering
Xwiki
6.1
1 CVEs0 on KEV0 new
XE
Xwiki Enterprise
Xwiki
–
1 CVEs0 on KEV0 new
XW
Xwiki Watch
Xwiki
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-53837
XW
xwiki-rendering
xwiki
9.9
2%
Sep 18org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
CVE-2026-53966
XW
xwiki-platform
xwiki
7.1
1%
Sep 15XWiki Platform: Privilege escalation from edit to script right through Live Data editing
CVE-2026-34151
XW
xwiki-platform
xwiki
8.2
1%
Sep 14XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
CVE-2026-48048
XW
xwiki-platform
xwiki
7.5
1%
Aug 10XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
CVE-2026-48047
XW
xwiki-platform
xwiki
5.9
1%
Aug 7XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
CVE-2026-33137
XW
xwiki-platform
xwiki
9.3
1%
May 20XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CVE-2026-23734
XW
xwiki-commons
xwiki
9.3
19%
May 20XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
CVE-2025-51846
CR
Cryptpad
Xwiki
7.5
1%
Apr 30CryptPad unbounded WebSocket frame flood
CVE-2026-40105
XW
xwiki-platform
xwiki
6.1
1%
Apr 15XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
CVE-2026-40104
OR
org.xwiki.platform:xwiki-platform-legacy-oldcore
xwiki
8.2
0%
Apr 15XWiki's REST APIs can list all pages/spaces, leading to unavailability
CVE-2026-33229
XW
xwiki-platform
xwiki
9.8
1%
Apr 8XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
CVE-2025-66024
BA
Blog Application
Xwiki
9.0
0%
Mar 4XWiki Blog Application home page vulnerable to Stored XSS via Post Title
CVE-2026-26000
XW
xwiki-platform
xwiki
6.1
0%
Feb 12XWiki Platform affected by click-jacking through CSS injection in comments
CVE-2026-24128
XW
xwiki-platform
xwiki
6.1
1%
Jan 23XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
CVE-2025-65091
FC
Full Calendar Macro
Xwiki
10.0
0%
Jan 10XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
CVE-2025-65090
FC
Full Calendar Macro
Xwiki
5.3
0%
Jan 10XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
CVE-2025-66474
XW
xwiki-rendering
xwiki
8.8
1%
Dec 10XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
CVE-2025-66473
XW
xwiki-platform
xwiki
7.5
0%
Dec 10XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
CVE-2025-66472
XW
xwiki-platform
xwiki
6.1
1%
Dec 10XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
CVE-2025-65036
PM
Pro Macros
Xwiki
8.3
0%
Dec 5XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro
CVE-2025-55749
XW
xwiki-platform
xwiki
7.5
1%
Dec 1The XWiki Jetty package (XJetty) allows accessing any application file through URL
CVE-2025-65089
PM
Pro Macros
Xwiki
6.5
0%
Nov 19XWiki view file macro: User can view content of office file without view rights on the attachment
CVE-2025-52472
XW
xwiki-platform
xwiki
9.3
2%
Oct 6XWiki Platform vulnerable to HQL injection via wiki and space search REST API
CVE-2025-55728
PM
Pro Macros
Xwiki
9.8
1%
Sep 9XWiki Remote Macros vulnerable to remote code execution using the panel macro
CVE-2025-55727
PM
Pro Macros
Xwiki
9.8
1%
Sep 9XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro
CVE-2025-55748
XW
xwiki-platform
xwiki
7.5
2%
Sep 3XWiki Platform's configuration files can be accessed through jsx and sx endpoints
CVE-2025-55747
XW
xwiki-platform
xwiki
9.1
2%
Sep 3XWiki Platform's configuration files can be accessed through the webjars API
CVE-2025-58049
XW
xwiki-platform
xwiki
7.5
0%
Aug 28XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
CVE-2025-51990
XW
Xwiki
Xwiki
4.8
0%
Aug 20XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section…
CVE-2025-51991
XW
Xwiki
Xwiki
8.8
4%
Aug 20XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global…
CVE-2025-54125
XW
xwiki-platform
xwiki
6.5
1%
Aug 5XWiki Platform: Password and email exposure in xml.vm fields
CVE-2025-54124
XW
xwiki-platform
xwiki
6.5
0%
Aug 5XWiki Platform: Any user with editing rights can access password properties through Database List Properties
CVE-2025-32430
XW
xwiki-platform
xwiki
6.1
1%
Aug 5XWiki Platform contains Reflected XSS vulnerability in two templates
CVE-2025-54385
XW
xwiki-platform
xwiki
9.8
1%
Jul 26XWiki Platform's searchDocuments API allows for SQL injection
CVE-2025-32429
XW
xwiki-platform
xwiki
9.8
85%
Jul 24XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
CVE-2025-53836
XW
xwiki-rendering
xwiki
8.8
1%
Jul 14XWiki Rendering is vulnerable to RCE attacks when processing nested macros
CVE-2025-53835
XW
xwiki-rendering
xwiki
9.0
0%
Jul 14XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
CVE-2025-49591
CR
Cryptpad
Xwiki
9.1
1%
Jun 18CryptPad 2FA Bypass Vulnerability
CVE-2025-49590
CR
Cryptpad
Xwiki
6.1
0%
Jun 18CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
CVE-2025-49587
XW
xwiki-platform
xwiki
8.0
0%
Jun 13XWiki does not require right warnings for notification displayer objects
CVE-2025-49586
XW
xwiki-platform
xwiki
8.8
1%
Jun 13XWiki allows remote code execution through preview of XClass changes in AWM editor
CVE-2025-49585
XW
xwiki-platform
xwiki
8.0
0%
Jun 13XWiki does not require right warnings for XClass definitions
CVE-2025-49584
XW
xwiki-platform
xwiki
7.5
0%
Jun 13XWiki makes title of inaccessible pages available through the class property values REST API
CVE-2025-49583
XW
xwiki-platform
xwiki
3.5
0%
Jun 13XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
CVE-2025-49582
XW
xwiki-platform
xwiki
8.0
1%
Jun 13XWiki's required right warnings for macros are incomplete
CVE-2025-49581
XW
xwiki-platform
xwiki
8.8
1%
Jun 13XWiki allows remote code execution through default value of wiki macro wiki-type parameters
CVE-2025-49580
XW
xwiki-platform
xwiki
8.0
0%
Jun 13XWiki allows privilege escalation through link refactoring
CVE-2024-56158
XW
xwiki-platform
xwiki
9.8
1%
Jun 12XWiki allows SQL injection in query endpoint of REST API with Oracle
CVE-2025-48063
XW
xwiki-platform
xwiki
8.8
1%
May 21XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right
CVE-2025-46554
XW
xwiki-platform
xwiki
5.3
1%
Apr 30XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
CVE-2025-46557
XW
xwiki-platform
xwiki
9.8
1%
Apr 30Any user with view access to the XWiki space can change the authenticator
CVE-2025-46558
XW
Xwiki
Xwiki
9.0
0%
Apr 30org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content
CVE-2025-32973
XW
xwiki-platform
xwiki
9.0
0%
Apr 30org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
CVE-2025-32974
XW
xwiki-platform
xwiki
9.0
0%
Apr 30org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
CVE-2025-32972
XW
xwiki-platform
xwiki
5.3
1%
Apr 30The lesscss script service allows cache clearing without programming right
CVE-2025-32971
XW
xwiki-platform
xwiki
3.8
0%
Apr 30XWiki Solr script service doesn't take dropped programming right into account
CVE-2025-32970
XW
xwiki-platform
xwiki
6.1
1%
Apr 30org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
CVE-2025-32969
XW
xwiki-platform
xwiki
9.8
80%
Apr 23org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
CVE-2025-32968
XW
xwiki-platform
xwiki
8.8
1%
Apr 23org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
CVE-2025-32783
XW
xwiki-platform
xwiki
4.3
0%
Apr 16XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki