XWiki

Records305All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical143CVSS 9.0–10.0

CVSS high84CVSS 7.0–8.9

Exploited now

XWiki records in CISA KEV

TI-2025-18595 XWiki Platform Eval Injection Vulnerability CRITICAL 100KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records

Xwiki 248 records CRITICAL Cryptpad 5 records HIGH Pro Macros 5 records HIGH Commons 4 records HIGH Xwiki-rendering 4 records HIGH Pdf Viewer Macro 3 records HIGH Change Request 2 records HIGH Ckeditor Integration 2 records HIGH

Records

305 records

TI-2025-18595 CVE-2025-24893 · GHSA-rr6p-3pfg-562j

Remote code execution as guest via SolrSearchMacros request in xwiki

CRITICAL 100KEV

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99974 Published 2025-02-20 Fixed in 15.10.11, 16.4.1 CWE-95

TI-2023-25214 CVE-2023-46731 · GHSA-62pr-qqf7-hh89

Remote code execution through the section parameter in Administration as guest in XWiki Platform

CRITICAL 91

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.897 Published 2023-11-06 Fixed in 14.10.14, 15.5.1 CWE-94

TI-2025-23500 CVE-2025-32429 · GHSA-vr59-gm53-v7cq

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

CRITICAL 90

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.85496 Published 2025-07-24 Fixed in 16.10.6, 17.3.0-rc-1 CWE-89

TI-2025-23979 CVE-2025-32969 · GHSA-f69v-xrj8-rhxf

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

CRITICAL 88

XWiki is a generic wiki platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.80009 Published 2025-04-23 Fixed in 15.10.16, 16.4.6 +1 CWE-89

TI-2024-20829 CVE-2024-31465 · GHSA-34fj-r5gq-7395

XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

CRITICAL 88

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.75575 Published 2024-04-10 Fixed in 14.10.20, 15.5.4 +1 CWE-95

TI-2024-14375 CVE-2024-21650 · GHSA-rj7p-xjv7-7229

XWiki Remote Code Execution vulnerability via user registration

CRITICAL 86

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.9348 Published 2024-01-08 Fixed in 14.10.17, 15.5.3 +1 CWE-95

TI-2023-19071 CVE-2023-37462 · GHSA-h4vp-69r8-gvjg

Injection in xwiki-platform

CRITICAL 86

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.91592 Published 2023-07-14 Fixed in 14.4.8, 14.10.4 CWE-74

TI-2024-21083 CVE-2024-31984 · GHSA-xm4h-3jxr-m3c6

XWiki Platform: Remote code execution through space title and Solr space facet

HIGH 84

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.82996 Published 2024-04-10 Fixed in 14.10.20, 15.5.4 +1 CWE-95

TI-2023-27667 CVE-2023-50721 · GHSA-7654-vfh6-rw6x

XWiki Platform RCE from account through SearchAdmin

HIGH 83

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.78812 Published 2023-12-15 Fixed in 14.10.15, 15.5.2 +1 CWE-94

TI-2023-18310 CVE-2023-36469 · GHSA-94pf-92hw-2hjc

Code injection through NotificationRSSService in XWiki Platform

HIGH 83

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.82032 Published 2023-06-29 Fixed in 14.10.6, 15.2-rc-1 CWE-74

TI-2025-35151 CVE-2025-55730

XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro

HIGH 82

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00734 Published 2025-09-09 Fixed in 1.26.5 CWE-116

TI-2025-35150 CVE-2025-55729

XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro

HIGH 82

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00734 Published 2025-09-09 Fixed in 1.26.5 CWE-116

TI-2025-35149 CVE-2025-55728

XWiki Remote Macros vulnerable to remote code execution using the panel macro

HIGH 82

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00793 Published 2025-09-09 Fixed in 1.26.5 CWE-95

TI-2025-35148 CVE-2025-55727

XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro

HIGH 82

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01048 Published 2025-09-09 Fixed in 1.26.5 CWE-95

TI-2024-28457 CVE-2024-42489

Pro Macros Remote Code Execution via Viewpdf and similar macros

HIGH 82

Pro Macros provides XWiki rendering macros.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01063 Published 2024-08-12 Fixed in 1.10.1 CWE-74

TI-2024-21095 CVE-2024-31996 · GHSA-hf43-47q4-fhq5

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

HIGH 82

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02104 Published 2024-04-10 Fixed in 14.10.19, 15.5.4 +1 CWE-95

TI-2024-21081 CVE-2024-31982 · GHSA-2858-8cfx-69m9

XWiki Platform: Remote code execution as guest via DatabaseSearch

HIGH 82

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.3452 Published 2024-04-10 Fixed in 14.10.20, 15.5.4 +1 CWE-95

TI-2023-17596 CVE-2023-35150 · GHSA-6mf5-36v9-3h2w

XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

HIGH 82

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.77654 Published 2023-06-23 Fixed in 14.4.8, 14.10.4 +1 CWE-95

TI-2023-13893 CVE-2023-29525 · GHSA-jgg7-w2rj-58cj

Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

HIGH 82

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.77752 Published 2023-04-18 Fixed in 14.4.8, 14.10.3. +3 CWE-74

TI-2023-13892 CVE-2023-29524 · GHSA-fc42-5w56-qw7h

Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform

HIGH 82

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.75693 Published 2023-04-18 Fixed in 14.10.3 CWE-74

TI-2023-13877 CVE-2023-29509 · GHSA-f4v8-58f6-mwj4

org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

HIGH 82

XWiki Commons are technical libraries common to several other top level XWiki projects.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.76183 Published 2023-04-16 Fixed in 13.10.11, 14.4.7 +1 CWE-95

TI-2023-11624 CVE-2023-26477 · GHSA-x2qm-r4wx-8gpg

org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

HIGH 82

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.74757 Published 2023-03-02 Fixed in 13.10.10, 14.4.6 +1 CWE-95

TI-2022-16522 CVE-2022-36099 · GHSA-xr6m-2p4m-jvqf

XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

HIGH 82

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.76348 Published 2022-09-08 Fixed in 13.10.6, 14.4 CWE-94

TI-2024-21096 CVE-2024-31997 · GHSA-c2gg-4gq4-jv5j

XWiki Platform remote code execution from account through UIExtension parameters

HIGH 81

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.73925 Published 2024-04-10 Fixed in 14.10.19, 15.5.4 +1 CWE-862

TI-2023-24159 CVE-2023-45138 · GHSA-f776-w9v2-7vfj

Change Request Application vulnerable to XSS and remote code execution through change request title

HIGH 81

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.71744 Published 2023-10-12 Fixed in 1.9.2 CWE-79

Open these records in search →