Log in Start free

xwiki

Products

ProductCVEsExploitedLatest
XWiki Platform2331Sep 15, 2026
xwiki-commons9–May 20, 2026
xwiki-rendering7–Sep 18, 2026
org.xwiki.platform:xwiki-platform-legacy-oldcore1–Apr 15, 2026
org.xwiki.platform:xwiki-platform-oldcore1–Apr 15, 2026

Exploited and recent CVEs

  • CVE-2025-24893 Critical 9.8 Exploited Remote code execution as guest via SolrSearchMacros request in xwiki 100.0%
  • CVE-2025-53837 Critical 9.9 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue 1.5%
  • CVE-2026-53966 High 7.1 XWiki Platform: Privilege escalation from edit to script right through Live Data editing 0.8%
  • CVE-2026-34151 High 8.2 XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ 2.5%
  • CVE-2026-48048 High 7.5 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests 2.0%
  • CVE-2026-48047 Medium 5.9 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin 0.7%
  • CVE-2026-33137 Critical 9.3 XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} 0.6%
  • CVE-2026-23734 Critical 9.3 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash 18.5%
  • CVE-2026-40105 Medium 6.5 XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality 0.5%
  • CVE-2026-40104 High 8.2 XWiki's REST APIs can list all pages/spaces, leading to unavailability 0.4%
  • CVE-2026-40104 High 8.2 XWiki's REST APIs can list all pages/spaces, leading to unavailability 0.4%
  • CVE-2026-33229 Critical 9.8 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API 0.5%
  • CVE-2026-26000 Medium 5.3 XWiki Platform affected by click-jacking through CSS injection in comments 0.3%
  • CVE-2026-24128 Medium 6.5 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages 0.6%
  • CVE-2025-66474 High 8.7 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection 1.0%
  • CVE-2025-66473 High 8.7 XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis 0.4%
  • CVE-2025-66472 Medium 6.5 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication 0.5%
  • CVE-2025-55749 High 8.7 The XWiki Jetty package (XJetty) allows accessing any application file through URL 1.6%
  • CVE-2025-52472 Critical 9.3 XWiki Platform vulnerable to HQL injection via wiki and space search REST API 2.4%
  • CVE-2025-55748 Critical 9.3 XWiki Platform's configuration files can be accessed through jsx and sx endpoints 1.8%
  • CVE-2025-55747 Critical 9.3 XWiki Platform's configuration files can be accessed through the webjars API 1.8%
  • CVE-2025-58049 Medium 5.8 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses 0.4%
  • CVE-2025-54125 High 8.7 XWiki Platform: Password and email exposure in xml.vm fields 1.5%
  • CVE-2025-54124 High 7.1 XWiki Platform: Any user with editing rights can access password properties through Database List Properties 0.5%
  • CVE-2025-32430 Medium 6.5 XWiki Platform contains Reflected XSS vulnerability in two templates 0.7%
  • CVE-2025-54385 High 8.6 XWiki Platform's searchDocuments API allows for SQL injection 0.7%
  • CVE-2025-32429 Critical 9.3 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter 85.5%
  • CVE-2025-53836 Critical 10.0 XWiki Rendering is vulnerable to RCE attacks when processing nested macros 0.6%
  • CVE-2025-53835 Critical 9.1 XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax 0.4%
  • CVE-2025-49587 Medium 6.4 XWiki does not require right warnings for notification displayer objects 0.4%