XW
Product
xwiki-platform
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 14High 24Medium 22Low 2
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-49586 | 8.8 | Jun 13 | XWiki allows remote code execution through preview of XClass changes in AWM editor Affected: >= 7.2-milestone-2, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-49581 | 8.8 | Jun 13 | XWiki allows remote code execution through default value of wiki macro wiki-type parameters Affected: >= 11.10.11, < 12.0; >= 12.6.3, < 12.7; >= 12.8-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-48063 | 8.8 | May 21 | XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right Affected: >= 16.10.0-rc-1, < 16.10.4; >= 17.0.0-rc-1, < 17.1.0-rc-1 |
| CVE-2025-32968 | 8.8 | Apr 23 | org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API Affected: >= 1.6-milestone-1, < 15.10.16; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.1 |
| CVE-2024-55879 | 8.8 | Dec 12 | XWiki allows RCE from script right in configurable sections Affected: >= 2.3, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0 |
| CVE-2024-55877 | 8.8 | Dec 12 | XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Affected: >= 9.7-rc-1, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1; >= 16.5.0-rc-1, < 16.5.0 |
| CVE-2024-55662 | 8.8 | Dec 12 | XWiki allows remote code execution through the extension sheet Affected: >= 3.3-milestone-1, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0 |
| CVE-2024-37901 | 8.8 | Jul 31 | XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Affected: >= 15.6-rc-1, < 15.10.2; >= 15.0-rc-1, < 15.5.5; >= 9.2-rc-1, < 14.10.21 |
| CVE-2026-34151 | 8.2 | Sep 14 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ Affected: < 17.10.5; >= 18.0.0-rc-1, < 18.2.0 |
| CVE-2025-49587 | 8.0 | Jun 13 | XWiki does not require right warnings for notification displayer objects Affected: >= 15.9-rc-1, < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 |
| CVE-2025-49585 | 8.0 | Jun 13 | XWiki does not require right warnings for XClass definitions Affected: < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 |
| CVE-2025-49582 | 8.0 | Jun 13 | XWiki's required right warnings for macros are incomplete Affected: >= 15.9-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-49580 | 8.0 | Jun 13 | XWiki allows privilege escalation through link refactoring Affected: >= 17.0.0-rc-1, < 17.1.0-rc-1; >= 16.5.0-rc-1, < 16.10.4; >= 8.2, < 16.4.7; >= 7.4.5, < 8.0-milestone-1 |
| CVE-2025-23025 | 8.0 | Jan 14 | Privilege escalation (PR) through realtime WYSIWYG editing in XWiki Affected: >= 13.9-rc-1, < 15.10.12; >= 16.0.0, < 16.4.1; >= 16.5.0, < 16.6.0-rc-1 |
| CVE-2024-43401 | 8.0 | Aug 19 | In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them Affected: < 15.10-rc-1 |
| CVE-2024-37899 | 8.0 | Jun 20 | Disabling a user account changes its author, allowing RCE from user account in XWiki Affected: >= 13.4.7, <= 13.5; >= 13.10.3, < 14.10.21; >= 15.0-rc-1, < 15.5.5; >= 15.6-rc-1, < 15.10.6; >= 16.0.0-rc-1, < 16.0.0 |
| CVE-2026-48048 | 7.5 | Aug 10 | XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests Affected: >= 6.2.1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 |
| CVE-2025-66473 | 7.5 | Dec 10 | XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis Affected: < 16.10.11; >= 17.0.0-rc-1, < 17.4.4; >= 17.5.0-rc-1, < 17.7.0-rc-1 |
| CVE-2025-55749 | 7.5 | Dec 1 | The XWiki Jetty package (XJetty) allows accessing any application file through URL Affected: >= 16.7.0, < 16.10.11; >= 17.0.0-rc1, < 17.4.4; >= 17.5.0, < 17.7.0 |
| CVE-2025-55748 | 7.5 | Sep 3 | XWiki Platform's configuration files can be accessed through jsx and sx endpoints Affected: >= 4.2-milestone-2, < 16.10.7 |
| CVE-2025-58049 | 7.5 | Aug 28 | XWiki PDF export jobs store sensitive cookies unencrypted in job statuses Affected: >= 14.4.2, < 16.4.8; >= 16.5.0-rc-1, < 16.10.7; >= 17.0.0-rc-1, < 17.4.0-rc-1 |
| CVE-2025-49584 | 7.5 | Jun 13 | XWiki makes title of inaccessible pages available through the class property values REST API Affected: >= 10.9, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0 |
| CVE-2025-29924 | 7.5 | Mar 19 | XWiki uses the wrong wiki reference in AuthorizationManager Affected: >= 6.1-rc-1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1 |
| CVE-2026-53966 | 7.1 | Sep 15 | XWiki Platform: Privilege escalation from edit to script right through Live Data editing Affected: >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0-rc-1 |
Showing 24