XWiki

Records305All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical143CVSS 9.0–10.0

CVSS high84CVSS 7.0–8.9

Exploited now

XWiki records in CISA KEV

TI-2025-18595 XWiki Platform Eval Injection Vulnerability CRITICAL 100KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records

Xwiki 248 records CRITICAL Cryptpad 5 records HIGH Pro Macros 5 records HIGH Commons 4 records HIGH Xwiki-rendering 4 records HIGH Pdf Viewer Macro 3 records HIGH Change Request 2 records HIGH Ckeditor Integration 2 records HIGH

Records

248 records in Xwiki · all components

TI-2025-18595 CVE-2025-24893 · GHSA-rr6p-3pfg-562j

Remote code execution as guest via SolrSearchMacros request in xwiki

CRITICAL 100KEV

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99974 Published 2025-02-20 Fixed in 15.10.11, 16.4.1 CWE-95

TI-2023-25214 CVE-2023-46731 · GHSA-62pr-qqf7-hh89

Remote code execution through the section parameter in Administration as guest in XWiki Platform

CRITICAL 91

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.897 Published 2023-11-06 Fixed in 14.10.14, 15.5.1 CWE-94

TI-2025-23500 CVE-2025-32429 · GHSA-vr59-gm53-v7cq

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

CRITICAL 90

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.85496 Published 2025-07-24 Fixed in 16.10.6, 17.3.0-rc-1 CWE-89

TI-2025-23979 CVE-2025-32969 · GHSA-f69v-xrj8-rhxf

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

CRITICAL 88

XWiki is a generic wiki platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.80009 Published 2025-04-23 Fixed in 15.10.16, 16.4.6 +1 CWE-89

TI-2024-20829 CVE-2024-31465 · GHSA-34fj-r5gq-7395

XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

CRITICAL 88

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.75575 Published 2024-04-10 Fixed in 14.10.20, 15.5.4 +1 CWE-95

TI-2024-14375 CVE-2024-21650 · GHSA-rj7p-xjv7-7229

XWiki Remote Code Execution vulnerability via user registration

CRITICAL 86

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.9348 Published 2024-01-08 Fixed in 14.10.17, 15.5.3 +1 CWE-95

TI-2023-19071 CVE-2023-37462 · GHSA-h4vp-69r8-gvjg

Injection in xwiki-platform

CRITICAL 86

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.91592 Published 2023-07-14 Fixed in 14.4.8, 14.10.4 CWE-74

TI-2024-21083 CVE-2024-31984 · GHSA-xm4h-3jxr-m3c6

XWiki Platform: Remote code execution through space title and Solr space facet

HIGH 84

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.82996 Published 2024-04-10 Fixed in 14.10.20, 15.5.4 +1 CWE-95

TI-2023-27667 CVE-2023-50721 · GHSA-7654-vfh6-rw6x

XWiki Platform RCE from account through SearchAdmin

HIGH 83

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.78812 Published 2023-12-15 Fixed in 14.10.15, 15.5.2 +1 CWE-94

TI-2023-18310 CVE-2023-36469 · GHSA-94pf-92hw-2hjc

Code injection through NotificationRSSService in XWiki Platform

HIGH 83

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.82032 Published 2023-06-29 Fixed in 14.10.6, 15.2-rc-1 CWE-74

TI-2024-21095 CVE-2024-31996 · GHSA-hf43-47q4-fhq5

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

HIGH 82

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02104 Published 2024-04-10 Fixed in 14.10.19, 15.5.4 +1 CWE-95

TI-2024-21081 CVE-2024-31982 · GHSA-2858-8cfx-69m9

XWiki Platform: Remote code execution as guest via DatabaseSearch

HIGH 82

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.3452 Published 2024-04-10 Fixed in 14.10.20, 15.5.4 +1 CWE-95

TI-2023-17596 CVE-2023-35150 · GHSA-6mf5-36v9-3h2w

XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

HIGH 82

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.77654 Published 2023-06-23 Fixed in 14.4.8, 14.10.4 +1 CWE-95

TI-2023-13893 CVE-2023-29525 · GHSA-jgg7-w2rj-58cj

Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

HIGH 82

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.77752 Published 2023-04-18 Fixed in 14.4.8, 14.10.3. +3 CWE-74

TI-2023-13892 CVE-2023-29524 · GHSA-fc42-5w56-qw7h

Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform

HIGH 82

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.75693 Published 2023-04-18 Fixed in 14.10.3 CWE-74

TI-2023-13877 CVE-2023-29509 · GHSA-f4v8-58f6-mwj4

org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

HIGH 82

XWiki Commons are technical libraries common to several other top level XWiki projects.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.76183 Published 2023-04-16 Fixed in 13.10.11, 14.4.7 +1 CWE-95

TI-2023-11624 CVE-2023-26477 · GHSA-x2qm-r4wx-8gpg

org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

HIGH 82

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.74757 Published 2023-03-02 Fixed in 13.10.10, 14.4.6 +1 CWE-95

TI-2022-16522 CVE-2022-36099 · GHSA-xr6m-2p4m-jvqf

XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

HIGH 82

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.76348 Published 2022-09-08 Fixed in 13.10.6, 14.4 CWE-94

TI-2024-21096 CVE-2024-31997 · GHSA-c2gg-4gq4-jv5j

XWiki Platform remote code execution from account through UIExtension parameters

HIGH 81

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.73925 Published 2024-04-10 Fixed in 14.10.19, 15.5.4 +1 CWE-862

TI-2023-21049 CVE-2023-40176 · GHSA-h8cm-3v5f-rgp6

SXSS in the user profile via the timezone displayer

HIGH 81

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.79989 Published 2023-08-23 Fixed in 14.10.5 CWE-79

TI-2022-16523 CVE-2022-36100 · GHSA-2g5c-228j-p52x

XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

HIGH 81

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.73608 Published 2022-09-08 Fixed in 13.10.6, 14.4 CWE-94

TI-2023-27665 CVE-2023-50719 · GHSA-p6cp-6r35-32mh

XWiki Platform Solr search discloses password hashes of all users

HIGH 80

XWiki Platform is a generic wiki platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83548 Published 2023-12-15 Fixed in 14.10.15, 15.5.2 +1 CWE-200

TI-2023-15375 CVE-2023-32071 · GHSA-j9h5-vcgv-2jfm

XWiki Platform vulnerable to RXSS via editor parameter - importinline template

HIGH 79

XWiki Platform is a generic wiki platform.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.70386 Published 2023-05-09 Fixed in 14.4.8, 14.10.4 CWE-116

TI-2023-13884 CVE-2023-29516 · GHSA-3989-4c6x-725f

Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

HIGH 79

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.65869 Published 2023-04-18 Fixed in 13.10.11, 14.4.8 +1 CWE-74

TI-2022-16521 CVE-2022-36098 · GHSA-c5v8-2q4r-5w9v

XWiki Platform Mentions UI vulnerable to Cross-site Scripting

HIGH 79

XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.71607 Published 2022-09-08 Fixed in 13.10.6, 14.4 CWE-79

Open these records in search →