XW
Product
Xwiki
On CISA KEVExploited in the wild
248
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 32High 119Medium 88Low 3
Watch
Add Xwiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-34464 | 5.4 | Jun 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 2.2.1 before 14.4.8; 14.10 before 14.10.5; 15.0 |
| CVE-2023-29515 | 5.4 | Apr 19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 13.10.11; 14.0 before 14.4.8; 14.5 before 14.10.1 |
| CVE-2023-29508 | 5.4 | Apr 16 | XWiki Commons are technical libraries common to several other top level XWiki projects Affected: before 13.10.11; 14.4.0 before 14.4.7; 14.10 |
| CVE-2023-29206 | 5.4 | Apr 15 | XWiki Commons are technical libraries common to several other top level XWiki projects Affected: after 3.0 through 14.8; 3.0; 3.0; 3.0; 3.0 |
| CVE-2023-29205 | 5.4 | Apr 15 | XWiki Commons are technical libraries common to several other top level XWiki projects Affected: through 14.7 |
| CVE-2023-26056 | 5.4 | Mar 2 | XWiki Platform is a generic wiki platform Affected: 3.1 before 13.10.10; 14.0 before 14.4.5; 14.5 before 14.8; 3.0; 3.0; 3.0 |
| CVE-2023-26480 | 5.4 | Mar 2 | XWiki Platform is a generic wiki platform Affected: 12.10 before 13.10.10; 14.0 before 14.4.7; 14.5 before 14.9; 14.9 |
| CVE-2022-23620 | 5.4 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: through 13.6 |
| CVE-2022-23615 | 5.4 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 1.0 before 13.0 |
| CVE-2021-43841 | 5.4 | Feb 4 | XWiki is a generic wiki platform offering runtime services for applications built on top of it Affected: 1.0 before 12.10.6; 13.0 through 13.2 |
| CVE-2021-32729 | 5.4 | Jul 1 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 11.6.1 before 12.6.8; 12.7 before 12.10.4 |
| CVE-2021-21379 | 5.4 | Mar 12 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 11.4 before 11.10.11; 12.0 before 12.6.3; 12.7 through 12.7.1 |
| CVE-2021-3137 | 5.4 | Jan 20 | XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section Affected: 12.10.2 |
| CVE-2018-16277 | 5.4 | Sep 28 | The Image Import function in XWiki through 10.7 has XSS Affected: through 10.7 |
| CVE-2025-46554 | 5.3 | Apr 30 | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API Affected: 1.8.1 before 14.10.22; 15.0 before 15.10.12; 16.0.0 before 16.4.3; 16.5.0 before 16.7.0 |
| CVE-2025-32972 | 5.3 | Apr 30 | The lesscss script service allows cache clearing without programming right Affected: 6.2 before 15.10.12; 16.0.0 before 16.4.3; 16.5.0 before 16.8.0; 6.1; 6.1; 6.1; +1 more |
| CVE-2025-29925 | 5.3 | Mar 19 | XWiki Platform is a generic wiki platform Affected: 1.9 before 15.10.14; 16.0.0 before 16.4.6; 16.5.0 through 16.10.0 |
| CVE-2024-46979 | 5.3 | Sep 18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 13.2 before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.1 |
| CVE-2024-45591 | 5.3 | Sep 10 | XWiki Platform document history including authors of any page exposed to unauthorized actors Affected: 1.8 before 15.10.9; 16.0.0 before 16.3.0 |
| CVE-2023-50720 | 5.3 | Dec 15 | XWiki Platform is a generic wiki platform Affected: before 14.10.5; 15.0 before 15.5.2; 15.6; 15.6; 15.7 |
| CVE-2023-29203 | 5.3 | Apr 15 | XWiki Commons are technical libraries common to several other top level XWiki projects Affected: 13.9 before 13.10.8; 14.4.0 before 14.4.3; 14.5 through 14.6; 13.9 |
| CVE-2022-41932 | 5.3 | Nov 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 13.10.8; 14.0.0 before 14.4.2; 14.5.0 before 14.6; 14.4.3; 14.4.4 |
| CVE-2022-24820 | 5.3 | Apr 8 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 12.10.11; 13.4.0 before 13.4.4; 13.9 |
| CVE-2022-24819 | 5.3 | Apr 8 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 12.10.11; 13.0.0 before 13.4.4; 13.9 |
| CVE-2021-32731 | 5.3 | Jul 1 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 13.1; 13.1 |
| CVE-2024-31464 | 4.9 | Apr 10 | XWiki Platform is a generic wiki platform Affected: 5.0 before 14.10.19; 15.0 before 15.5.4; 15.6 before 15.9 |
| CVE-2022-41929 | 4.9 | Nov 23 | org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or… Affected: after 11.7 before 13.10.7; after 14.0.0 before 14.4.2; 11.7; 14.4.3; 14.4.4 |
| CVE-2022-23621 | 4.9 | Feb 9 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 12.10.9; 13.4 before 13.4.3; 13.4.4 through 13.7 |
| CVE-2025-51990 | 4.8 | Aug 20 | XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section… Affected: through 17.3.0 |
| CVE-2023-35157 | 4.8 | Jun 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 14.10.6; 15.0 |
| CVE-2024-37900 | 4.6 | Jul 31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: after 4.2 before 14.10.21; 15.0 before 15.5.5; 15.6 before 15.10.6; 4.2; 4.2; 16.0.0 |
| CVE-2025-32783 | 4.3 | Apr 16 | XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki Affected: 5.0 through 16.7.1 |
| CVE-2024-37898 | 4.3 | Jul 31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 13.10.4 before 14.0; 14.2 before 14.10.21; after 15.0 before 15.5.5; 15.6 before 15.10.6; 15.0 |
| CVE-2024-38369 | 4.3 | Jun 24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 1.5 before 15.0 |
| CVE-2023-38509 | 4.3 | Nov 7 | XWiki Platform is a generic wiki platform Affected: 3.5 before 14.10.9 |
| CVE-2023-34466 | 4.3 | Jun 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 5.0.1 before 14.4.8; 14.10 before 14.10.4; 5.0 |
| CVE-2023-29513 | 4.3 | Apr 19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: before 14.10.1 |
| CVE-2022-41935 | 4.3 | Nov 23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 12.10.11 before 13.10.8; 14.0.0 before 14.4.3; 14.4.4; 14.4.5 |
| CVE-2022-36095 | 4.3 | Sep 8 | XWiki Platform is a generic wiki platform Affected: 2.3 before 13.10.6; 14.0 before 14.3; 2.0 |
| CVE-2025-32971 | 3.8 | Apr 30 | XWiki Solr script service doesn't take dropped programming right into account Affected: 4.5.1 before 15.10.13; 16.0.0 before 16.4.4; 16.5.0 before 16.8.0 |
| CVE-2025-49583 | 3.5 | Jun 13 | XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right Affected: before 15.10.16; 16.0.0 before 16.4.7; 16.5.0 before 16.10.2 |
| CVE-2022-29253 | 2.7 | May 25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it Affected: 8.4 before 13.10.3; 8.3 |
| CVE-2010-4642 | – | Dec 30 | Cross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 2.4; 0.9.543; 0.9.790; 0.9.793; 0.9.840; 0.9.1252; +3 more |
| CVE-2010-4641 | – | Dec 30 | SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: through 2.4; 0.9.543; 0.9.790; 0.9.793; 0.9.840; 0.9.1252; +3 more |
| CVE-2007-4898 | – | Sep 14 | Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki… Affected: through 1.1_rc1 |
| CVE-2007-4888 | – | Sep 14 | The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights,… Affected: 1.0_b1; 1.0_b2 |
| CVE-2006-7223 | – | Sep 14 | PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users… Affected: 0.9.543; 0.9.790; 0.9.793; 0.9.840; 0.9.1252 |
| CVE-2005-4862 | – | Dec 31 | The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information via a search string that matches a… Affected: 0.9.793 |