xwiki XWiki Platform

• CVE-2025-24893 Critical 9.8 Exploited Remote code execution as guest via SolrSearchMacros request in xwiki 100.0%
• CVE-2026-53966 High 7.1 XWiki Platform: Privilege escalation from edit to script right through Live Data editing 0.8%
• CVE-2026-34151 High 8.2 XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ 2.5%
• CVE-2026-48048 High 7.5 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests 2.0%
• CVE-2026-48047 Medium 5.9 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin 0.7%
• CVE-2026-33137 Critical 9.3 XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} 0.6%
• CVE-2026-40105 Medium 6.5 XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality 0.5%
• CVE-2026-33229 Critical 9.8 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API 0.5%
• CVE-2026-26000 Medium 5.3 XWiki Platform affected by click-jacking through CSS injection in comments 0.3%
• CVE-2026-24128 Medium 6.5 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages 0.6%
• CVE-2025-66473 High 8.7 XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis 0.4%
• CVE-2025-66472 Medium 6.5 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication 0.5%
• CVE-2025-55749 High 8.7 The XWiki Jetty package (XJetty) allows accessing any application file through URL 1.6%
• CVE-2025-52472 Critical 9.3 XWiki Platform vulnerable to HQL injection via wiki and space search REST API 2.4%
• CVE-2025-55748 Critical 9.3 XWiki Platform's configuration files can be accessed through jsx and sx endpoints 1.8%
• CVE-2025-55747 Critical 9.3 XWiki Platform's configuration files can be accessed through the webjars API 1.8%
• CVE-2025-58049 Medium 5.8 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses 0.4%
• CVE-2025-54125 High 8.7 XWiki Platform: Password and email exposure in xml.vm fields 1.5%
• CVE-2025-54124 High 7.1 XWiki Platform: Any user with editing rights can access password properties through Database List Properties 0.5%
• CVE-2025-32430 Medium 6.5 XWiki Platform contains Reflected XSS vulnerability in two templates 0.7%
• CVE-2025-54385 High 8.6 XWiki Platform's searchDocuments API allows for SQL injection 0.7%
• CVE-2025-32429 Critical 9.3 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter 85.5%
• CVE-2025-49587 Medium 6.4 XWiki does not require right warnings for notification displayer objects 0.4%
• CVE-2025-49586 High 8.7 XWiki allows remote code execution through preview of XClass changes in AWM editor 0.7%
• CVE-2025-49585 High 8.6 XWiki does not require right warnings for XClass definitions 0.4%
• CVE-2025-49584 High 8.7 XWiki makes title of inaccessible pages available through the class property values REST API 0.4%
• CVE-2025-49583 Medium 5.1 XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right 0.3%
• CVE-2025-49582 High 8.6 XWiki's required right warnings for macros are incomplete 0.9%
• CVE-2025-49581 High 8.7 XWiki allows remote code execution through default value of wiki macro wiki-type parameters 0.6%
• CVE-2025-49580 High 8.5 XWiki allows privilege escalation through link refactoring 0.5%
• CVE-2024-56158 Critical 9.3 XWiki allows SQL injection in query endpoint of REST API with Oracle 0.5%
• CVE-2025-48063 Medium 4.8 XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right 1.0%
• CVE-2025-46554 Medium 5.3 XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API 1.1%
• CVE-2025-46557 High 8.4 Any user with view access to the XWiki space can change the authenticator 0.6%
• CVE-2025-32973 Critical 9.1 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right 0.4%
• CVE-2025-32974 Critical 9.1 org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type 0.4%
• CVE-2025-32972 Low 2.7 The lesscss script service allows cache clearing without programming right 0.5%
• CVE-2025-32971 Low 3.8 XWiki Solr script service doesn't take dropped programming right into account 0.4%
• CVE-2025-32970 Medium 6.1 org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability 0.6%
• CVE-2025-32969 Critical 9.3 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API 80.0%
• CVE-2025-32968 High 8.6 org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API 0.6%
• CVE-2025-32783 Medium 4.7 XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki 0.3%
• CVE-2025-29926 High 7.9 The WikiManager REST API allows any user to create wikis 0.6%
• CVE-2025-29925 High 8.7 XWiki allows unregistered users to access private pages information through REST endpoint 0.9%
• CVE-2025-29924 High 8.7 XWiki uses the wrong wiki reference in AuthorizationManager 0.4%
• CVE-2025-23025 Critical 9.1 Privilege escalation (PR) through realtime WYSIWYG editing in XWiki 0.4%
• CVE-2024-55879 Critical 9.1 XWiki allows RCE from script right in configurable sections 1.1%
• CVE-2024-55877 Critical 10.0 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList 1.6%
• CVE-2024-55876 Medium 5.4 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user 0.6%
• CVE-2024-55663 High 8.6 XWiki Platform has an SQL injection in getdocuments.vm with sort parameter 0.8%