Vulnerabilities

TI-2026-28931 CVE-2026-40105 · GHSA-w4fj-87j5-f25c

XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality

LOW 30

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00549 Published 2026-04-15 Fixed in 16.10.16, 17.4.8 +1 CWE-80

TI-2026-28930 CVE-2026-40104 · GHSA-mrqg-xmgm-rc5g

XWiki's REST APIs can list all pages/spaces, leading to unavailability

LOW 37

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.004 Published 2026-04-15 Fixed in 16.10.16, 17.4.8 +1 CWE-770

TI-2026-25648 CVE-2026-33229 · GHSA-h259-74h5-4rh9

XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

MEDIUM 46

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0055 Published 2026-04-08 Fixed in 17.4.8, 17.10.1 CWE-862

TI-2026-21014 CVE-2026-26000 · GHSA-74rh-c5rh-88vg

XWiki Platform affected by click-jacking through CSS injection in comments

LOW 24

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00311 Published 2026-02-12 Fixed in 17.9.0, 17.4.6 +1 CWE-1021

TI-2026-19446 CVE-2026-24128 · GHSA-wvqx-m5px-6cmp

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

LOW 30

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00551 Published 2026-01-23 Fixed in 16.10.12, 17.4.5 +1 CWE-79

TI-2025-40900 CVE-2025-66473 · GHSA-cc84-q3v3-mhgf

XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

HIGH 77

XWiki is an open-source wiki software platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00403 Published 2025-12-10 Fixed in 16.10.11, 17.4.4 +1 CWE-770

TI-2025-40899 CVE-2025-66472 · GHSA-7vpr-jm38-wr7w

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

LOW 35

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00507 Published 2025-12-10 Fixed in 16.10.10, 17.4.2 CWE-79

TI-2025-35169 CVE-2025-55749 · GHSA-53gx-j3p6-2rw9

The XWiki Jetty package (XJetty) allows accessing any application file through URL

MEDIUM 47

XWiki is an open-source wiki software platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01577 Published 2025-12-01 Fixed in 16.10.11, 17.4.4 +1 CWE-284

TI-2025-35168 CVE-2025-55748 · GHSA-m63c-3rmg-r2cf

XWiki Platform's configuration files can be accessed through jsx and sx endpoints

MEDIUM 44

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01843 Published 2025-09-03 Fixed in 16.10.7 CWE-23

TI-2025-35167 CVE-2025-55747 · GHSA-qww7-89xh-x7m7

XWiki Platform's configuration files can be accessed through the webjars API

MEDIUM 44

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01751 Published 2025-09-03 Fixed in 16.10.7, 17.4.0-rc-1 CWE-23

TI-2025-35892 CVE-2025-58049 · GHSA-9m7c-m33f-3429

XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

LOW 33

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00381 Published 2025-08-28 Fixed in 16.4.8, 16.10.7 +1 CWE-212

TI-2025-32449 CVE-2025-51991 · GHSA-94x5-j7vw-fqv4

XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in…

HIGH 73

XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03688 Published 2025-08-20 No fix listed CWE-79

TI-2025-32448 CVE-2025-51990 · GHSA-6jx2-qgxg-f4q9

XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS)…

MEDIUM 55

XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00498 Published 2025-08-20 No fix listed CWE-79

TI-2025-33968 CVE-2025-54125 · GHSA-57q2-6cp4-9mq3

XWiki Platform: Password and email exposure in xml.vm fields

HIGH 77

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01481 Published 2025-08-05 Fixed in 16.4.7, 16.10.5 +1 CWE-359

TI-2025-33967 CVE-2025-54124 · GHSA-r38m-cgpg-qj69

XWiki Platform: Any user with editing rights can access password properties through Database List Properties

MEDIUM 64

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00516 Published 2025-08-05 Fixed in 16.4.7, 16.10.5 +1 CWE-359

TI-2025-23501 CVE-2025-32430 · GHSA-m9x4-w7p9-mxhx

XWiki Platform contains Reflected XSS vulnerability in two templates

HIGH 68

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00708 Published 2025-08-05 Fixed in 16.4.8, 16.10.6 +1 CWE-79

TI-2025-34193 CVE-2025-54385 · GHSA-p9qm-p942-q3w5

XWiki Platform's searchDocuments API allows for SQL injection

MEDIUM 46

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00684 Published 2025-07-26 Fixed in 16.10.6, 17.3.0-rc-1 CWE-20

TI-2025-23500 CVE-2025-32429 · GHSA-vr59-gm53-v7cq

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

CRITICAL 90

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.85496 Published 2025-07-24 Fixed in 16.10.6, 17.3.0-rc-1 CWE-89

TI-2025-33728 CVE-2025-53836 · GHSA-32mf-57h2-64x9

XWiki Rendering is vulnerable to RCE attacks when processing nested macros

HIGH 76

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc).

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00638 Published 2025-07-14 Fixed in 13.10.11, 14.4.7 +1 CWE-863

TI-2025-33727 CVE-2025-53835 · GHSA-w3wh-g4m9-783p

XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

HIGH 74

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc).

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00408 Published 2025-07-14 Fixed in 14.10 CWE-79

TI-2025-31600 CVE-2025-49587 · GHSA-j7p2-87q3-44w7

XWiki does not require right warnings for notification displayer objects

MEDIUM 64

XWiki is an open-source wiki software platform.

CVSS 4.0MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00438 Published 2025-06-13 Fixed in 15.10.16, 16.4.7 +1 CWE-357

TI-2025-31599 CVE-2025-49586 · GHSA-jp4x-w9cj-97q7

XWiki allows remote code execution through preview of XClass changes in AWM editor

HIGH 73

XWiki is an open-source wiki software platform.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00749 Published 2025-06-13 Fixed in 16.4.7, 16.10.3 +1 CWE-863

TI-2025-31598 CVE-2025-49585 · GHSA-59w6-r9hm-439h

XWiki does not require right warnings for XClass definitions

MEDIUM 40

XWiki is a generic wiki platform.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00438 Published 2025-06-13 Fixed in 15.10.16, 16.4.7 +1 CWE-357

TI-2025-31597 CVE-2025-49584 · GHSA-mvp5-qx9c-c3fv

XWiki makes title of inaccessible pages available through the class property values REST API

HIGH 77

XWiki is a generic wiki platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00445 Published 2025-06-13 Fixed in 16.4.7, 16.10.3 +1 CWE-201

TI-2025-31596 CVE-2025-49583 · GHSA-ff6v-w58f-v97w

XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

MEDIUM 56

XWiki is a generic wiki platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00271 Published 2025-06-13 Fixed in 15.10.16, 16.4.7 +1 CWE-270

Vulnerabilities

Filters