Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-53966
  • github.com/xwiki/xwiki-platform
 XWiki Platform: Privilege escalation from edit to script right through Live Data editing 15 Sep
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-34151
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ 14 Sep
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-48048
  • github.com/xwiki/xwiki-platform
 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests 10 Aug
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-48047
  • github.com/xwiki/xwiki-platform
 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin 07 Aug
  • Fix available
  • Severity - 5.9 (Medium)
CVE-2026-33137
  • github.com/xwiki/xwiki-platform
 XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} 20 May
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2026-40105
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality 15 Apr
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-40104
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki's REST APIs can list all pages/spaces, leading to unavailability 15 Apr
  • Fix available
  • Severity - 6.9 (Medium)
CVE-2026-33229
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API 08 Apr
  • Fix available
  • Severity - 8.6 (High)
CVE-2026-26000
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform affected by click-jacking through CSS injection in comments 12 Feb
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-24128
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages 23 Jan
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2025-66474
  • github.com/xwiki/xwiki-platform
  • github.com/xwiki/xwiki-rendering
 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection 10 Dec 2025
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-66473
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis 10 Dec 2025
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-66472
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication 10 Dec 2025
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2025-55749
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 The XWiki Jetty package (XJetty) allows accessing any application file through URL 01 Dec 2025
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-52472
  • github.com/xwiki/xwiki-platform
 XWiki Platform vulnerable to HQL injection via wiki and space search REST API 06 Oct 2025
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2025-55748
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform's configuration files can be accessed through jsx and sx endpoints 03 Sep 2025
  • Fix available
  • Severity - 9.3 (Critical)
Load more...