Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.xwiki.platform:xwiki-platform-distribution-war

5 known vulnerabilities (3 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 3 critical, 2 high
Registry
Maven Central

Advisories 5

  • CVE-2025-32429Critical 9.3

    XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

    Affected: from 9.4-rc-1, fixed in 16.10.6; from 17.0.0-rc-1, fixed in 17.3.0-rc-1.

  • XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

    Affected: from 6.3-milestone-2, fixed in 13.10.5; from 14.0-rc-1, fixed in 14.3-rc-1.

  • XWiki Denial of Service attack through attachments

    Affected: from 14.10, fixed in 14.10.18; from 15.0-rc-1, fixed in 15.5.3; from 15.6-rc-1, fixed in 15.8-rc-1.

  • CVE-2023-32071Critical 9.1

    XWiki Platform vulnerable to RXSS via editor parameter - importinline template

    Affected: from 2.2-milestone-1, fixed in 14.4.8; from 14.5, fixed in 14.10.4.

  • CVE-2023-29525Critical 10.0

    Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

    Affected: from 12.6.1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.6-rc-1.