XW
Product
xwiki-platform
On CISA KEVExploited in the wild
43
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 12High 16Medium 13Low 2
Watch
Add xwiki-platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54125 | 6.5 | Aug 5 | XWiki Platform: Password and email exposure in xml.vm fields Affected: >= 1.1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.5; >= 17.0.0-rc-1, < 17.2.0-rc-1 |
| CVE-2025-54124 | 6.5 | Aug 5 | XWiki Platform: Any user with editing rights can access password properties through Database List Properties Affected: >= 9.8-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.5; >= 17.0.0-rc-1, < 17.2.0-rc-1 |
| CVE-2026-40105 | 6.1 | Apr 15 | XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality Affected: >= 10.4-rc-1, < 16.10.16; >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1 |
| CVE-2026-26000 | 6.1 | Feb 12 | XWiki Platform affected by click-jacking through CSS injection in comments Affected: >= 17.5.0, < 17.9.0; >= 17.0.0-rc-1, < 17.4.6; < 16.10.13 |
| CVE-2026-24128 | 6.1 | Jan 23 | XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages Affected: >= 7.0-milestone-2, < 16.10.12; >= 17.0.0-rc-1, < 17.4.5; >= 17.5.0-rc-1, < 17.8.0-rc-1 |
| CVE-2025-66472 | 6.1 | Dec 10 | XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication Affected: org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 6.2-milestone-1, < 16.10.10; org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 17.0.0-rc-1, < 17.4.2; org.xwiki.platform:xwiki-platform-web-templates >= 6.2-milestone-1, < 16.10.10; org.xwiki.platform:xwiki-platform-web-templates >= 17.0.0-rc-1, < 17.4.2 |
| CVE-2025-32430 | 6.1 | Aug 5 | XWiki Platform contains Reflected XSS vulnerability in two templates Affected: >= 4.2-milestone-3, < 16.4.8; >= 16.5.0-rc-1, < 16.10.6; >= 17.0.0-rc-1, < 17.3.0-rc-1 |
| CVE-2025-32970 | 6.1 | Apr 30 | org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability Affected: >= 13.5-rc-1, < 15.10.13; >= 16.0.0-rc-1, < 16.4.4; >= 16.5.0-rc-1, < 16.8.0 |
| CVE-2026-48047 | 5.9 | Aug 7 | XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin Affected: >= 9.6-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 |
| CVE-2025-46554 | 5.3 | Apr 30 | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API Affected: >= 1.8.1, < 14.10.22; >= 15.0-rc-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.7.0 |
| CVE-2025-32972 | 5.3 | Apr 30 | The lesscss script service allows cache clearing without programming right Affected: >= 6.1-milestone-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.8.0-rc-1 |
| CVE-2024-45591 | 5.3 | Sep 10 | XWiki Platform document history including authors of any page exposed to unauthorized actors Affected: >= 1.8.0, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0-rc-1 |
| CVE-2025-32783 | 4.3 | Apr 16 | XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki Affected: >= 5.0, <= 16.7.1 |
Showing 13