Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.xwiki.platform:xwiki-platform-web

15 known vulnerabilities (5 critical, 5 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 5 critical, 5 high, 5 medium
Registry
Maven Central

Advisories 15

  • CVE-2026-26000Medium 5.3

    XWiki Platform affected by click-jacking through CSS injection in comments

    Affected: from 17.5.0, fixed in 17.9.0; from 17.0.0-rc-1, fixed in 17.4.6; fixed in 16.10.13.

  • CVE-2023-45137Critical 9.1

    XWiki Platform XSS with edit right in the create document form for existing pages

    Affected: from 3.1-milestone-2, fixed in 13.4-rc-1.

  • CVE-2023-45135Critical 9.1

    XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

    Affected: from 7.2-milestone-2, fixed in 14.10.12.

  • CVE-2023-45134Critical 9.1

    XWiki Platform XSS vulnerability from account in the create page form via template provider

    Affected: from 3.1-milestone-1, fixed in 13.4-rc-1.

  • CVE-2023-34464Critical 9.1

    XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template

    Affected: from 2.2.1, fixed in 14.4.8.

  • Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro

    Affected: from 1.9-milestone-2, fixed in 13.10.10; from 14.0-rc-1, fixed in 14.4.6; from 14.5, fixed in 14.9.

  • CVE-2023-26473Medium 6.5

    XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm

    Affected: from 1.3-rc-1, fixed in 13.10.11; from 14.0, fixed in 14.4.7; from 14.5, fixed in 14.10.

  • XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

    Affected: from 1.0, fixed in 13.10.6; from 14.0, fixed in 14.3-rc-1.

  • XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard

    Affected: from 8.0-rc-1, fixed in 13.10.5; from 14.0, fixed in 14.3-rc-1.

  • XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor

    Affected: from 14.0, fixed in 14.2.

  • CVE-2022-24820Medium 5.3

    Unauthenticated user can list hidden document from multiple velocity templates

    Affected: fixed in 12.10.11; from 13.0.0, fixed in 13.4.4; from 13.5.0, fixed in 13.9.

  • CVE-2022-23619Medium 5.3

    Information exposure in xwiki-platform

    Affected: from 13.5RC1, fixed in 13.6RC1; from 13.0.0, fixed in 13.4.1; fixed in 12.10.9.

  • CVE-2021-32731Medium 5.3

    The reset password form reveal users email address

    Affected: from 13.1, fixed in 13.2.

  • CVE-2021-29459Critical 9.6

    XSS Cross Site Scripting

    Affected: fixed in 12.6.3; from 12.6.4, fixed in 12.8.

  • XWiki Platform before 12.8 mishandles escaping in the property displayer.

    Affected: fixed in 12.8.