# org.xwiki.platform:xwiki-platform-oldcore (Maven) vulnerabilities 46 known vulnerabilities (14 critical, 15 high, 15 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.xwiki.platform/xwiki-platform-oldcore ## Advisories (46) ### [CVE-2026-34151](https://cve.now/CVE-2026-34151): XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ - Severity: High 8.2 - Published: Sep 14, 2026 - Affected: fixed in 17.10.5; from 18.0.0-rc-1, fixed in 18.2.0. ### [CVE-2026-40104](https://cve.now/CVE-2026-40104): XWiki's REST APIs can list all pages/spaces, leading to unavailability - Severity: Medium 6.9 - Published: Apr 15, 2026 - Affected: from 1.8-rc-1, fixed in 16.10.16; from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1. ### [CVE-2026-33229](https://cve.now/CVE-2026-33229): XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API - Severity: High 8.6 - Published: Apr 8, 2026 - Affected: from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1. ### [CVE-2025-54125](https://cve.now/CVE-2025-54125): XWiki Platform: Password and email exposure in xml.vm fields - Severity: High 8.7 - Published: Aug 5, 2025 - Affected: from 1.1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.5; from 17.0.0-rc-1, fixed in 17.2.0-rc-1. ### [CVE-2025-54124](https://cve.now/CVE-2025-54124): XWiki Platform: Any user with editing rights can access password properties through Database List Properties - Severity: High 7.1 - Published: Aug 5, 2025 - Affected: from 9.8-rc-1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.5; from 17.0.0-rc-1, fixed in 17.2.0-rc-1. ### [CVE-2025-54385](https://cve.now/CVE-2025-54385): XWiki Platform's searchDocuments API allows for SQL injection - Severity: High 8.6 - Published: Jul 26, 2025 - Affected: from 1.0, fixed in 16.10.6; from 17.0.0-rc1, fixed in 17.3.0-rc-1. ### [CVE-2025-49586](https://cve.now/CVE-2025-49586): XWiki allows remote code execution through preview of XClass changes in AWM editor - Severity: High 8.7 - Published: Jun 13, 2025 - Affected: from 7.2-milestone-2, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.3; from 17.0.0-rc-1, fixed in 17.0.0. ### [CVE-2024-56158](https://cve.now/CVE-2024-56158): XWiki allows SQL injection in query endpoint of REST API with Oracle - Severity: Critical 9.3 - Published: Jun 12, 2025 - Affected: from 1.0, fixed in 15.10.16; from 16.0.0-rc-1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.2. ### [CVE-2025-32968](https://cve.now/CVE-2025-32968): org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API - Severity: High 8.6 - Published: Apr 23, 2025 - Affected: from 1.6-milestone-1, fixed in 15.10.16; from 16.0.0-rc-1, fixed in 16.4.6; from 16.5.0-rc-1, fixed in 16.10.1. ### [CVE-2024-43400](https://cve.now/CVE-2024-43400): XWiki Platform allows XSS through XClass name in string properties - Severity: Critical 9.1 - Published: Aug 19, 2024 - Affected: from 1.1.2, fixed in 14.10.21; from 15.0-rc-1, fixed in 15.5.5; from 15.6-rc-1, fixed in 15.10.6; from 16.0.0-rc-1, fixed in 16.0.0. ### [CVE-2024-37898](https://cve.now/CVE-2024-37898): XWiki Platform vulnerable to document deletion and overwrite from edit - Severity: Medium 4.3 - Published: Jul 31, 2024 - Affected: from 13.10.4, fixed in 14.10.21; from 14.2, fixed in 14.10.21; from 15.0, fixed in 15.5.5; from 15.6-rc-1, fixed in 15.10.6. ### [CVE-2024-37899](https://cve.now/CVE-2024-37899): Disabling a user account changes its author, allowing RCE from user account in XWiki - Severity: Critical 9.1 - Published: Jun 20, 2024 - Affected: from 13.4.7, fixed in 14.10.21; from 13.10.3, fixed in 14.10.21; from 15.0-rc-1, fixed in 15.5.5; from 15.6-rc-1, fixed in 15.10.6; from 16.0.0-rc-1, fixed in 16.0.0. ### [CVE-2024-31987](https://cve.now/CVE-2024-31987): XWiki Platform remote code execution from account via custom skins support - Severity: Critical 10.0 - Published: Apr 10, 2024 - Affected: from 6.4-milestone-1, fixed in 14.10.19; from 15.0-rc-1, fixed in 15.5.4; from 15.6-rc-1, fixed in 15.10-rc-1. ### [CVE-2024-31981](https://cve.now/CVE-2024-31981): XWiki Platform: Privilege escalation (PR) from user registration through PDFClass - Severity: Critical 10.0 - Published: Apr 10, 2024 - Affected: from 3.0.1, fixed in 14.10.20; from 15.0-rc-1, fixed in 15.5.4; from 15.6-rc-1, fixed in 15.10-rc-1. ### [CVE-2024-31464](https://cve.now/CVE-2024-31464): XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted - Severity: Medium 6.8 - Published: Apr 10, 2024 - Affected: from 5.0-rc-1, fixed in 14.10.19; from 15.0-rc-1, fixed in 15.5.4; from 15.6-rc-1, fixed in 15.9-rc-1. ### [CVE-2024-21648](https://cve.now/CVE-2024-21648): XWiki has no right protection on rollback action - Severity: High 8.0 - Published: Jan 8, 2024 - Affected: from 1.0, fixed in 14.10.17. ### [CVE-2023-46243](https://cve.now/CVE-2023-46243): Code execution via the edit action in XWiki platform - Severity: Critical 10.0 - Published: Nov 7, 2023 - Affected: from 15.0, fixed in 15.2-rc-1; from 1.0, fixed in 14.10.6. ### [CVE-2023-46242](https://cve.now/CVE-2023-46242): Code injection in XWiki Platform - Severity: Critical 9.7 - Published: Nov 7, 2023 - Affected: from 1.0, fixed in 14.10.7; from 15.0, fixed in 15.2-rc-1. ### [CVE-2023-37911](https://cve.now/CVE-2023-37911): org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents - Severity: Medium 6.5 - Published: Oct 25, 2023 - Affected: from 9.4-rc-1, fixed in 14.10.8; from 15.0-rc-1, fixed in 15.3-rc-1. ### [CVE-2023-41046](https://cve.now/CVE-2023-41046): Velocity execution without script rights in Xwiki platform - Severity: Medium 6.3 - Published: Sep 1, 2023 - Affected: from 7.2, fixed in 14.10.10; from 15.0-rc-1, fixed in 15.4-rc-1. ### [CVE-2023-40572](https://cve.now/CVE-2023-40572): XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action - Severity: Critical 9.1 - Published: Aug 24, 2023 - Affected: from 3.2-milestone-3, fixed in 14.10.9; from 15.0-rc-1, fixed in 15.4-rc-1. ### [CVE-2023-36468](https://cve.now/CVE-2023-36468): Upgrading doesn't prevent exploiting vulnerable XWiki documents - Severity: Critical 10.0 - Published: Jun 29, 2023 - Affected: from 2.0, fixed in 14.10.7; from 15.0-rc-1, fixed in 15.2-rc-1. ### [CVE-2023-35157](https://cve.now/CVE-2023-35157): XWiki Platform vulnerable to reflected cross-site scripting via delattachment action - Severity: High 8.5 - Published: Jun 23, 2023 - Affected: from 3.2-milestone-3, fixed in 14.10.6; from 15.0-rc-0, fixed in 15.1-rc-1. ### [CVE-2023-32068](https://cve.now/CVE-2023-32068): URL Redirection to Untrusted Site in XWiki - Severity: Medium 4.7 - Published: May 15, 2023 - Affected: fixed in 14.10.4. ### [CVE-2023-29523](https://cve.now/CVE-2023-29523): Code injection in display method used in user profiles in xwiki-platform - Severity: Critical 10.0 - Published: Apr 18, 2023 - Affected: from 3.3-milestone-1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.2. ### [CVE-2023-29526](https://cve.now/CVE-2023-29526): Async and display macro allow displaying and interacting with any document in restricted mode - Severity: Critical 10.0 - Published: Apr 18, 2023 - Affected: from 10.11.1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.3. ### [CVE-2023-29507](https://cve.now/CVE-2023-29507): org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors - Severity: Critical 9.1 - Published: Apr 16, 2023 - Affected: from 14.5, fixed in 14.10; from 14.4.1, fixed in 14.4.7. ### [CVE-2023-29208](https://cve.now/CVE-2023-29208): Data leak through deleted documents - Severity: High 7.5 - Published: Apr 15, 2023 - Affected: from 1.2-milestone-1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.7; from 14.5, fixed in 14.10. ### [CVE-2023-29204](https://cve.now/CVE-2023-29204): URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore - Severity: Medium 4.7 - Published: Apr 15, 2023 - Affected: from 6.0-rc-1, fixed in 13.10.10; from 14.0-rc-1, fixed in 14.4.4; from 14.5, fixed in 14.8-rc-1. ### [CVE-2023-26470](https://cve.now/CVE-2023-26470): In XWiki Platform, saving a document with a large object number leads to persistent OOM errors - Severity: Medium 5.7 - Published: Mar 2, 2023 - Affected: fixed in 14.0-rc-1. ### [CVE-2023-26474](https://cve.now/CVE-2023-26474): XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author - Severity: Critical 10.0 - Published: Mar 2, 2023 - Affected: from 13.10, fixed in 13.10.11; from 14.0, fixed in 14.4.7; from 14.5, fixed in 14.10. ### [CVE-2022-41932](https://cve.now/CVE-2022-41932): Creation of new database tables through login form on PostgreSQL - Severity: High 7.5 - Published: Nov 23, 2022 - Affected: fixed in 13.10.8; from 14.0.0, fixed in 14.4.2; from 14.5.0, fixed in 14.6-rc-1. ### [CVE-2022-41929](https://cve.now/CVE-2022-41929): Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore - Severity: Medium 4.9 - Published: Nov 23, 2022 - Affected: from 11.7RC1, fixed in 13.10.7; from 14.0.0, fixed in 14.4.2. ### [CVE-2022-36092](https://cve.now/CVE-2022-36092): XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action - Severity: High 7.5 - Published: Sep 8, 2022 - Affected: fixed in 13.10.4; from 14.0, fixed in 14.2. ### [CVE-2022-36090](https://cve.now/CVE-2022-36090): org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users - Severity: High 8.1 - Published: Sep 8, 2022 - Affected: from 1.1, fixed in 13.10.5; from 14.0, fixed in 14.3-rc-1. ### [CVE-2022-31166](https://cve.now/CVE-2022-31166): XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups - Severity: High 8.1 - Published: Sep 7, 2022 - Affected: from 11.3.7, fixed in 13.10.4; from 14.0-rc-1, fixed in 14.2-rc-1. ### [CVE-2022-29253](https://cve.now/CVE-2022-29253): Path Traversal in XWiki Platform - Severity: Low 2.7 - Published: May 25, 2022 - Affected: from 8.3-rc-1, fixed in 13.10.3. ### [CVE-2022-23621](https://cve.now/CVE-2022-23621): Missing authorization in xwiki-platform - Severity: Medium 5.5 - Published: Feb 9, 2022 - Affected: from 13.6-rc-1, fixed in 13.7-rc-1; from 13.0.0, fixed in 13.4.3; fixed in 12.10.9. ### [CVE-2022-23618](https://cve.now/CVE-2022-23618): Open Redirect in xwiki-platform - Severity: Medium 4.7 - Published: Feb 9, 2022 - Affected: fixed in 12.10.7; from 13.0.0, fixed in 13.3RC1. ### [CVE-2022-23617](https://cve.now/CVE-2022-23617): Missing authorization in xwiki-platform - Severity: Medium 6.5 - Published: Feb 9, 2022 - Affected: fixed in 12.10.6; from 13.0, fixed in 13.2-rc-1. ### [CVE-2022-23615](https://cve.now/CVE-2022-23615): Partial authorization bypass on document save in xwiki-platform - Severity: Medium 5.4 - Published: Feb 9, 2022 - Affected: from 1.0, fixed in 13.0. ### [CVE-2021-43841](https://cve.now/CVE-2021-43841): XSS by SVG upload in xwiki-platform - Severity: Medium 5.4 - Published: Feb 4, 2022 - Affected: fixed in 12.10.6; from 13.0, fixed in 13.3RC1. ### [CVE-2021-29459](https://cve.now/CVE-2021-29459): XSS Cross Site Scripting - Severity: Critical 9.6 - Published: Apr 20, 2021 - Affected: fixed in 12.6.3; from 12.6.4, fixed in 12.8. ### [CVE-2020-15252](https://cve.now/CVE-2020-15252): RCE in XWiki - Severity: High 8.5 - Published: Oct 16, 2020 - Affected: fixed in 11.10.6; from 12.0, fixed in 12.5. ### [CVE-2020-15171](https://cve.now/CVE-2020-15171): Users with SCRIPT rights can execute arbitrary code in XWiki - Severity: Medium 6.6 - Published: Sep 10, 2020 - Affected: fixed in 11.10.5; from 12.0.0, fixed in 12.2.1. ### [CVE-2006-7223](https://cve.now/CVE-2006-7223): PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document… - Severity: Unrated - Published: Sep 14, 2007 - Affected: from 0.9.543, fixed in 1.0B1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.xwiki.platform:xwiki-platform-oldcore Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.