Read the docs

XWiki

Records305All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical143CVSS 9.0–10.0
CVSS high84CVSS 7.0–8.9

Exploited now

XWiki records in CISA KEV
TI-2025-18595 XWiki Platform Eval Injection Vulnerability Priority CRITICAL 100KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records
Xwiki 248 records CRITICAL Cryptpad 5 records HIGH Pro Macros 5 records HIGH Commons 4 records HIGH Xwiki-rendering 4 records HIGH Pdf Viewer Macro 3 records HIGH Change Request 2 records HIGH Ckeditor Integration 2 records HIGH

Records

5 records in Cryptpad · all components

TI-2025-31604 CVE-2025-49591

CryptPad 2FA Bypass Vulnerability

Priority HIGH 66

CryptPad is a collaboration suite.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.00518 Published 2025-06-18 Fixed in 2025.3.0 CWE-284
TI-2025-32422 CVE-2025-51846 · GHSA-jmrh-f3j8-q3c4

CryptPad unbounded WebSocket frame flood

Priority MEDIUM 44

CryptPad 2025.3.1 allows unbounded WebSocket frame flood.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00578 Published 2026-04-30 Fixed in 2026.2.2 CWE-770
TI-2019-11412 CVE-2019-15302 · GHSA-gwjm-w339-m6p5

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker…

Priority LOW 32

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modificati…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01358 Published 2019-09-11 No fix listed CWE-404
Open these records in search →