Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.xwiki.platform:xwiki-platform-legacy-oldcore

5 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 critical, 3 high, 1 medium
Registry
Maven Central

Advisories 5

  • CVE-2026-40104Medium 6.9

    XWiki's REST APIs can list all pages/spaces, leading to unavailability

    Affected: from 1.8-rc-1, fixed in 16.10.16; from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1.

  • XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

    Affected: from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1.

  • XWiki Platform: Password and email exposure in xml.vm fields

    Affected: from 1.1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.5; from 17.0.0-rc-1, fixed in 17.2.0-rc-1.

  • XWiki Platform: Any user with editing rights can access password properties through Database List Properties

    Affected: from 9.8-rc-1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.5; from 17.0.0-rc-1, fixed in 17.2.0-rc-1.

  • CVE-2023-26474Critical 10.0

    XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

    Affected: from 13.10, fixed in 13.10.11; from 14.0, fixed in 14.4.7; from 14.5, fixed in 14.10.