Log in Start free

xwiki-contrib

Products

ProductCVEsExploitedLatest
Mocca Calendar3–Aug 3, 2025
macro-fullcalendar2–Jan 10, 2026
application-changerequest2–Dec 4, 2023
oidc2–Oct 6, 2025
application-admintools2–Nov 20, 2023
macro-plantuml1–May 4, 2026
syntax-markdown1–Apr 30, 2025
application-blog1–Sep 8, 2025
application-blog-ui1–Mar 4, 2026
application-ckeditor1–Jan 4, 2023
jira1–Apr 3, 2025

Exploited and recent CVEs

  • CVE-2026-42140 Medium 4.4 Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter 0.2%
  • CVE-2025-66024 High 8.6 XWiki Blog Application home page vulnerable to Stored XSS via Post Title 0.4%
  • CVE-2025-65091 Critical 10.0 XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService 0.3%
  • CVE-2025-65090 Medium 5.3 XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService 0.3%
  • CVE-2025-49594 Critical 9.2 XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right 0.4%
  • CVE-2025-58365 High 8.7 XWiki Blog Application: Privilege Escalation (PR) from account through blog content 0.6%
  • CVE-2025-52133 Medium 6.4 The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import. 0.3%
  • CVE-2025-52132 Medium 6.4 The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page. 0.3%
  • CVE-2025-52131 Medium 6.4 The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field. 0.3%
  • CVE-2025-46558 Critical 9.1 org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content 0.5%
  • CVE-2025-31487 High 7.7 The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server 0.4%
  • CVE-2023-49280 High 7.7 Data leak of password hash through xwiki change request 0.9%
  • CVE-2023-48293 High 8.8 XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries 0.4%
  • CVE-2023-48292 Critical 9.7 XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks 22.9%
  • CVE-2023-45138 Critical 10.0 Change Request Application vulnerable to XSS and remote code execution through change request title 71.7%
  • CVE-2023-22457 Critical 9.1 org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery 19.3%
  • CVE-2022-39387 Critical 9.1 XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication 1.2%