XW
Product
xwiki-platform
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 7Medium 9Low 0
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24893 In wildKEV | 9.8 | Feb 20 | Remote code execution as guest via SolrSearchMacros request in xwiki Affected: >= 5.3-milestone-2, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1 |
| CVE-2026-33229 | 9.8 | Apr 8 | XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API Affected: >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1 |
| CVE-2025-54385 | 9.8 | Jul 26 | XWiki Platform's searchDocuments API allows for SQL injection Affected: < 16.10.6; >= 17.0.0-rc1, < 17.3.0-rc-1 |
| CVE-2025-32429 | 9.8 | Jul 24 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter Affected: >= 9.4-rc-1, < 16.10.6; >= 17.0.0-rc-1, < 17.3.0-rc-1 |
| CVE-2026-33137 | 9.3 | May 20 | XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} Affected: >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 |
| CVE-2025-52472 | 9.3 | Oct 6 | XWiki Platform vulnerable to HQL injection via wiki and space search REST API Affected: >= 4.3-milestone-1, < 16.10.9; >= 17.0.0-rc-1, < 17.4.2 |
| CVE-2025-55747 | 9.1 | Sep 3 | XWiki Platform's configuration files can be accessed through the webjars API Affected: >= 6.1-milestone-2, < 16.10.7 |
Showing 7