# cve.now: XWiki

The newest entries naming XWiki as an affected vendor (up to 200), of 250 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-53837](https://cve.now/CVE-2025-53837.md): org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue (CVSS 9.9)
- [CVE-2026-53966](https://cve.now/CVE-2026-53966.md): XWiki Platform: Privilege escalation from edit to script right through Live Data editing (CVSS 7.1)
- [CVE-2026-34151](https://cve.now/CVE-2026-34151.md): XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ (CVSS 8.2)
- [CVE-2026-48048](https://cve.now/CVE-2026-48048.md): XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests (CVSS 7.5)
- [CVE-2026-48047](https://cve.now/CVE-2026-48047.md): XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin (CVSS 5.9)
- [CVE-2026-33137](https://cve.now/CVE-2026-33137.md): XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} (CVSS 9.3)
- [CVE-2026-23734](https://cve.now/CVE-2026-23734.md): XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash (CVSS 9.3)
- [CVE-2026-40105](https://cve.now/CVE-2026-40105.md): XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality (CVSS 6.5)
- [CVE-2026-40104](https://cve.now/CVE-2026-40104.md): XWiki's REST APIs can list all pages/spaces, leading to unavailability (CVSS 6.9)
- [CVE-2026-33229](https://cve.now/CVE-2026-33229.md): XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API (CVSS 8.6)
- [CVE-2026-26000](https://cve.now/CVE-2026-26000.md): XWiki Platform affected by click-jacking through CSS injection in comments (CVSS 5.3)
- [CVE-2026-24128](https://cve.now/CVE-2026-24128.md): XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages (CVSS 6.5)
- [CVE-2025-66474](https://cve.now/CVE-2025-66474.md): XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection (CVSS 8.7)
- [CVE-2025-66473](https://cve.now/CVE-2025-66473.md): XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis (CVSS 8.7)
- [CVE-2025-66472](https://cve.now/CVE-2025-66472.md): XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication (CVSS 6.5)
- [CVE-2025-55749](https://cve.now/CVE-2025-55749.md): The XWiki Jetty package (XJetty) allows accessing any application file through URL (CVSS 8.7)
- [CVE-2025-52472](https://cve.now/CVE-2025-52472.md): XWiki Platform vulnerable to HQL injection via wiki and space search REST API (CVSS 9.3)
- [CVE-2025-55748](https://cve.now/CVE-2025-55748.md): XWiki Platform's configuration files can be accessed through jsx and sx endpoints (CVSS 9.3)
- [CVE-2025-55747](https://cve.now/CVE-2025-55747.md): XWiki Platform's configuration files can be accessed through the webjars API (CVSS 9.3)
- [CVE-2025-58049](https://cve.now/CVE-2025-58049.md): XWiki PDF export jobs store sensitive cookies unencrypted in job statuses (CVSS 5.8)
- [CVE-2025-54125](https://cve.now/CVE-2025-54125.md): XWiki Platform: Password and email exposure in xml.vm fields (CVSS 8.7)
- [CVE-2025-54124](https://cve.now/CVE-2025-54124.md): XWiki Platform: Any user with editing rights can access password properties through Database List Properties (CVSS 7.1)
- [CVE-2025-32430](https://cve.now/CVE-2025-32430.md): XWiki Platform contains Reflected XSS vulnerability in two templates (CVSS 6.5)
- [CVE-2025-54385](https://cve.now/CVE-2025-54385.md): XWiki Platform's searchDocuments API allows for SQL injection (CVSS 8.6)
- [CVE-2025-32429](https://cve.now/CVE-2025-32429.md): XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter (CVSS 9.3)
- [CVE-2025-53836](https://cve.now/CVE-2025-53836.md): XWiki Rendering is vulnerable to RCE attacks when processing nested macros (CVSS 10.0)
- [CVE-2025-53835](https://cve.now/CVE-2025-53835.md): XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax (CVSS 9.1)
- [CVE-2025-49587](https://cve.now/CVE-2025-49587.md): XWiki does not require right warnings for notification displayer objects (CVSS 6.4)
- [CVE-2025-49586](https://cve.now/CVE-2025-49586.md): XWiki allows remote code execution through preview of XClass changes in AWM editor (CVSS 8.7)
- [CVE-2025-49585](https://cve.now/CVE-2025-49585.md): XWiki does not require right warnings for XClass definitions (CVSS 8.6)
- [CVE-2025-49584](https://cve.now/CVE-2025-49584.md): XWiki makes title of inaccessible pages available through the class property values REST API (CVSS 8.7)
- [CVE-2025-49583](https://cve.now/CVE-2025-49583.md): XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right (CVSS 5.1)
- [CVE-2025-49582](https://cve.now/CVE-2025-49582.md): XWiki's required right warnings for macros are incomplete (CVSS 8.6)
- [CVE-2025-49581](https://cve.now/CVE-2025-49581.md): XWiki allows remote code execution through default value of wiki macro wiki-type parameters (CVSS 8.7)
- [CVE-2025-49580](https://cve.now/CVE-2025-49580.md): XWiki allows privilege escalation through link refactoring (CVSS 8.5)
- [CVE-2024-56158](https://cve.now/CVE-2024-56158.md): XWiki allows SQL injection in query endpoint of REST API with Oracle (CVSS 9.3)
- [CVE-2025-48063](https://cve.now/CVE-2025-48063.md): XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right (CVSS 4.8)
- [CVE-2025-46554](https://cve.now/CVE-2025-46554.md): XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API (CVSS 5.3)
- [CVE-2025-46557](https://cve.now/CVE-2025-46557.md): Any user with view access to the XWiki space can change the authenticator (CVSS 8.4)
- [CVE-2025-32973](https://cve.now/CVE-2025-32973.md): org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right (CVSS 9.1)
- [CVE-2025-32974](https://cve.now/CVE-2025-32974.md): org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type (CVSS 9.1)
- [CVE-2025-32972](https://cve.now/CVE-2025-32972.md): The lesscss script service allows cache clearing without programming right (CVSS 2.7)
- [CVE-2025-32971](https://cve.now/CVE-2025-32971.md): XWiki Solr script service doesn't take dropped programming right into account (CVSS 3.8)
- [CVE-2025-32970](https://cve.now/CVE-2025-32970.md): org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability (CVSS 6.1)
- [CVE-2025-32969](https://cve.now/CVE-2025-32969.md): org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API (CVSS 9.3)
- [CVE-2025-32968](https://cve.now/CVE-2025-32968.md): org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API (CVSS 8.6)
- [CVE-2025-32783](https://cve.now/CVE-2025-32783.md): XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki (CVSS 4.7)
- [CVE-2025-29926](https://cve.now/CVE-2025-29926.md): The WikiManager REST API allows any user to create wikis (CVSS 7.9)
- [CVE-2025-29925](https://cve.now/CVE-2025-29925.md): XWiki allows unregistered users to access private pages information through REST endpoint (CVSS 8.7)
- [CVE-2025-29924](https://cve.now/CVE-2025-29924.md): XWiki uses the wrong wiki reference in AuthorizationManager (CVSS 8.7)
- [CVE-2025-24893](https://cve.now/CVE-2025-24893.md): Remote code execution as guest via SolrSearchMacros request in xwiki (CVSS 9.8, KEV)
- [CVE-2025-23025](https://cve.now/CVE-2025-23025.md): Privilege escalation (PR) through realtime WYSIWYG editing in XWiki (CVSS 9.1)
- [CVE-2024-55879](https://cve.now/CVE-2024-55879.md): XWiki allows RCE from script right in configurable sections (CVSS 9.1)
- [CVE-2024-55877](https://cve.now/CVE-2024-55877.md): XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList (CVSS 10.0)
- [CVE-2024-55876](https://cve.now/CVE-2024-55876.md): XWiki's scheduler in subwiki allows scheduling operations for any main wiki user (CVSS 5.4)
- [CVE-2024-55663](https://cve.now/CVE-2024-55663.md): XWiki Platform has an SQL injection in getdocuments.vm with sort parameter (CVSS 8.6)
- [CVE-2024-55662](https://cve.now/CVE-2024-55662.md): XWiki allows remote code execution through the extension sheet (CVSS 10.0)
- [CVE-2024-46978](https://cve.now/CVE-2024-46978.md): Missing checks for notification filter preferences editions in XWiki Platform (CVSS 6.5)
- [CVE-2024-46979](https://cve.now/CVE-2024-46979.md): Data leak of notification filters of users in XWiki Platform (CVSS 5.3)
- [CVE-2024-45591](https://cve.now/CVE-2024-45591.md): XWiki Platform document history including authors of any page exposed to unauthorized actors (CVSS 5.3)
- [CVE-2024-43400](https://cve.now/CVE-2024-43400.md): XWiki Platform allows XSS through XClass name in string properties (CVSS 9.1)
- [CVE-2024-43401](https://cve.now/CVE-2024-43401.md): In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them (CVSS 9.1)
- [CVE-2024-41947](https://cve.now/CVE-2024-41947.md): XWiki Platform XSS through conflict resolution (CVSS 9.1)
- [CVE-2024-37901](https://cve.now/CVE-2024-37901.md): XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet (CVSS 10.0)
- [CVE-2024-37900](https://cve.now/CVE-2024-37900.md): XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader (CVSS 6.4)
- [CVE-2024-37898](https://cve.now/CVE-2024-37898.md): XWiki Platform vulnerable to document deletion and overwrite from edit (CVSS 4.3)
- [CVE-2024-38369](https://cve.now/CVE-2024-38369.md): XWiki programming rights may be inherited by inclusion (CVSS 10.0)
- [CVE-2024-37899](https://cve.now/CVE-2024-37899.md): Disabling a user account changes its author, allowing RCE from user account in XWiki (CVSS 9.1)
- [CVE-2024-31997](https://cve.now/CVE-2024-31997.md): XWiki Platform remote code execution from account through UIExtension parameters (CVSS 10.0)
- [CVE-2024-31996](https://cve.now/CVE-2024-31996.md): XWiki Commons missing escaping of \`{\` in Velocity escapetool allows remote code execution (CVSS 10.0)
- [CVE-2024-31988](https://cve.now/CVE-2024-31988.md): XWiki Platform CSRF remote code execution through the realtime HTML Converter API (CVSS 9.7)
- [CVE-2024-31987](https://cve.now/CVE-2024-31987.md): XWiki Platform remote code execution from account via custom skins support (CVSS 10.0)
- [CVE-2024-31986](https://cve.now/CVE-2024-31986.md): XWiki Platform CSRF remote code execution through scheduler job's document reference (CVSS 9.1)
- [CVE-2024-31985](https://cve.now/CVE-2024-31985.md): XWiki Platform CSRF in the job scheduler (CVSS 5.4)
- [CVE-2024-31984](https://cve.now/CVE-2024-31984.md): XWiki Platform: Remote code execution through space title and Solr space facet (CVSS 10.0)
- [CVE-2024-31983](https://cve.now/CVE-2024-31983.md): XWiki Platform: Remote code execution from edit in multilingual wikis via translations (CVSS 10.0)
- [CVE-2024-31982](https://cve.now/CVE-2024-31982.md): XWiki Platform: Remote code execution as guest via DatabaseSearch (CVSS 10.0)
- [CVE-2024-31981](https://cve.now/CVE-2024-31981.md): XWiki Platform: Privilege escalation (PR) from user registration through PDFClass (CVSS 10.0)
- [CVE-2024-31465](https://cve.now/CVE-2024-31465.md): XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet (CVSS 10.0)
- [CVE-2024-31464](https://cve.now/CVE-2024-31464.md): XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted (CVSS 6.8)
- [CVE-2024-21648](https://cve.now/CVE-2024-21648.md): XWiki has no right protection on rollback action (CVSS 8.0)
- [CVE-2024-21651](https://cve.now/CVE-2024-21651.md): XWiki Denial of Service attack through attachments (CVSS 7.5)
- [CVE-2024-21650](https://cve.now/CVE-2024-21650.md): XWiki Remote Code Execution vulnerability via user registration (CVSS 10.0)
- [CVE-2023-50732](https://cve.now/CVE-2023-50732.md): Velocity execution without script right through tree macro (CVSS 8.3)
- [CVE-2023-50723](https://cve.now/CVE-2023-50723.md): XWiki Platform remote code execution/programming rights with configuration section from any user account (CVSS 10.0)
- [CVE-2023-50722](https://cve.now/CVE-2023-50722.md): XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass (CVSS 9.7)
- [CVE-2023-50721](https://cve.now/CVE-2023-50721.md): XWiki Platform RCE from account through SearchAdmin (CVSS 10.0)
- [CVE-2023-50719](https://cve.now/CVE-2023-50719.md): XWiki Platform Solr search discloses password hashes of all users (CVSS 7.5)
- [CVE-2023-50720](https://cve.now/CVE-2023-50720.md): XWiki Platform Solr search discloses email addresses of users (CVSS 5.3)
- [CVE-2023-48241](https://cve.now/CVE-2023-48241.md): XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service (CVSS 7.5)
- [CVE-2023-48240](https://cve.now/CVE-2023-48240.md): XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery (CVSS 9.1)
- [CVE-2023-46243](https://cve.now/CVE-2023-46243.md): Code execution via the edit action in XWiki platform (CVSS 10.0)
- [CVE-2023-46242](https://cve.now/CVE-2023-46242.md): Code injection in XWiki Platform (CVSS 9.7)
- [CVE-2023-46244](https://cve.now/CVE-2023-46244.md): Privilege escalation in Xwiki platform (CVSS 9.1)
- [CVE-2023-46731](https://cve.now/CVE-2023-46731.md): Remote code execution through the section parameter in Administration as guest in XWiki Platform (CVSS 10.0)
- [CVE-2023-46732](https://cve.now/CVE-2023-46732.md): Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform (CVSS 9.7)
- [CVE-2023-45137](https://cve.now/CVE-2023-45137.md): XWiki Platform XSS with edit right in the create document form for existing pages (CVSS 9.1)
- [CVE-2023-45136](https://cve.now/CVE-2023-45136.md): XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled (CVSS 9.7)
- [CVE-2023-45135](https://cve.now/CVE-2023-45135.md): XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title (CVSS 9.1)
- [CVE-2023-45134](https://cve.now/CVE-2023-45134.md): XWiki Platform XSS vulnerability from account in the create page form via template provider (CVSS 9.1)
- [CVE-2023-37913](https://cve.now/CVE-2023-37913.md): org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter (CVSS 10.0)
- [CVE-2023-37912](https://cve.now/CVE-2023-37912.md): XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro (CVSS 10.0)
- [CVE-2023-37911](https://cve.now/CVE-2023-37911.md): org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents (CVSS 6.5)
- [CVE-2023-37910](https://cve.now/CVE-2023-37910.md): org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move (CVSS 8.1)
- [CVE-2023-37909](https://cve.now/CVE-2023-37909.md): Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet (CVSS 10.0)
- [CVE-2023-37908](https://cve.now/CVE-2023-37908.md): org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability (CVSS 9.1)
- [CVE-2023-41046](https://cve.now/CVE-2023-41046.md): Velocity execution without script rights in Xwiki platform (CVSS 6.3)
- [CVE-2023-40573](https://cve.now/CVE-2023-40573.md): XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution (CVSS 9.1)
- [CVE-2023-40572](https://cve.now/CVE-2023-40572.md): XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action (CVSS 9.1)
- [CVE-2023-40177](https://cve.now/CVE-2023-40177.md): XWiki Platform privilege escalation (PR) from account through AWM content fields (CVSS 9.9)
- [CVE-2023-40176](https://cve.now/CVE-2023-40176.md): SXSS in the user profile via the timezone displayer (CVSS 9.1)
- [CVE-2023-37914](https://cve.now/CVE-2023-37914.md): Privilege escalation (PR)/RCE from account through Invitation subject/message (CVSS 9.9)
- [CVE-2023-38509](https://cve.now/CVE-2023-38509.md): XWiki Platform's obfuscated email addresses should not be sorted (CVSS 4.3)
- [CVE-2023-37462](https://cve.now/CVE-2023-37462.md): Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui (CVSS 10.0)
- [CVE-2023-37277](https://cve.now/CVE-2023-37277.md): XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API (CVSS 9.7)
- [CVE-2023-36477](https://cve.now/CVE-2023-36477.md): Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform (CVSS 9.1)
- [CVE-2023-36468](https://cve.now/CVE-2023-36468.md): Upgrading doesn't prevent exploiting vulnerable XWiki documents (CVSS 10.0)
- [CVE-2023-36469](https://cve.now/CVE-2023-36469.md): Code injection through NotificationRSSService in XWiki Platform (CVSS 10.0)
- [CVE-2023-36470](https://cve.now/CVE-2023-36470.md): Code injection in icon themes of XWiki Platform (CVSS 10.0)
- [CVE-2023-36471](https://cve.now/CVE-2023-36471.md): HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml (CVSS 9.1)
- [CVE-2023-35162](https://cve.now/CVE-2023-35162.md): XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template (CVSS 9.7)
- [CVE-2023-35161](https://cve.now/CVE-2023-35161.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page (CVSS 9.7)
- [CVE-2023-35160](https://cve.now/CVE-2023-35160.md): XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template (CVSS 9.7)
- [CVE-2023-35159](https://cve.now/CVE-2023-35159.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template (CVSS 9.7)
- [CVE-2023-35158](https://cve.now/CVE-2023-35158.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template (CVSS 9.7)
- [CVE-2023-35157](https://cve.now/CVE-2023-35157.md): XWiki Platform vulnerable to reflected cross-site scripting via delattachment action (CVSS 8.5)
- [CVE-2023-35156](https://cve.now/CVE-2023-35156.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template (CVSS 9.7)
- [CVE-2023-35155](https://cve.now/CVE-2023-35155.md): XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email (CVSS 8.8)
- [CVE-2023-35153](https://cve.now/CVE-2023-35153.md): XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters (CVSS 9.1)
- [CVE-2023-35152](https://cve.now/CVE-2023-35152.md): XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults (CVSS 10.0)
- [CVE-2023-35151](https://cve.now/CVE-2023-35151.md): XWiki Platform may show email addresses in clear in REST results (CVSS 7.5)
- [CVE-2023-35150](https://cve.now/CVE-2023-35150.md): XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application (CVSS 9.9)
- [CVE-2023-34467](https://cve.now/CVE-2023-34467.md): XWiki Platform may retrieve email addresses of all users (CVSS 7.5)
- [CVE-2023-34466](https://cve.now/CVE-2023-34466.md): XWiki Platform's tags on non-viewable pages can be revealed to users (CVSS 4.3)
- [CVE-2023-34465](https://cve.now/CVE-2023-34465.md): XWiki Platform's Mail.MailConfig can be edited by any user with edit rights (CVSS 10.0)
- [CVE-2023-34464](https://cve.now/CVE-2023-34464.md): XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template (CVSS 9.1)
- [CVE-2023-35166](https://cve.now/CVE-2023-35166.md): Privilege escalation (PR) from account through TipsPanel (CVSS 10.0)
- [CVE-2023-32068](https://cve.now/CVE-2023-32068.md): URL Redirection to Untrusted Site in XWiki (CVSS 4.7)
- [CVE-2023-32070](https://cve.now/CVE-2023-32070.md): Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers (CVSS 9.1)
- [CVE-2023-32071](https://cve.now/CVE-2023-32071.md): XWiki Platform vulnerable to RXSS via editor parameter - importinline template (CVSS 9.1)
- [CVE-2023-32069](https://cve.now/CVE-2023-32069.md): XWiki Platform privilege escalation (PR)/RCE from account through class sheet (CVSS 10.0)
- [CVE-2023-31126](https://cve.now/CVE-2023-31126.md): Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml (CVSS 9.1)
- [CVE-2023-29528](https://cve.now/CVE-2023-29528.md): Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml (CVSS 9.1)
- [CVE-2023-29517](https://cve.now/CVE-2023-29517.md): Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer (CVSS 7.5)
- [CVE-2023-29516](https://cve.now/CVE-2023-29516.md): Code injection from view right on XWiki.AttachmentSelector in xwiki-platform (CVSS 9.9)
- [CVE-2023-29515](https://cve.now/CVE-2023-29515.md): Cross-site scripting (XSS) in xwiki-platform (CVSS 7.7)
- [CVE-2023-29514](https://cve.now/CVE-2023-29514.md): Code injection in template provider administration in xwiki-platform (CVSS 10.0)
- [CVE-2023-29513](https://cve.now/CVE-2023-29513.md): Users can be created even when registration is disabled without validation via the template macro in xwiki-platform (CVSS 5.0)
- [CVE-2023-29512](https://cve.now/CVE-2023-29512.md): Code injection in xwiki-platform-web-templates (CVSS 9.9)
- [CVE-2023-29510](https://cve.now/CVE-2023-29510.md): Code injection via unescaped translations in xwiki-platform (CVSS 10.0)
- [CVE-2023-29522](https://cve.now/CVE-2023-29522.md): Code injection from view right on XWiki.ClassSheet in xwiki-platform (CVSS 9.9)
- [CVE-2023-29521](https://cve.now/CVE-2023-29521.md): Code injection from account/view through VFS Tree macro in xwiki-platform (CVSS 8.4)
- [CVE-2023-29520](https://cve.now/CVE-2023-29520.md): Page render failure due to broken translations in xwiki-platform (CVSS 4.3)
- [CVE-2023-29519](https://cve.now/CVE-2023-29519.md): Code injection in org.xwiki.platform:xwiki-platform-attachment-ui (CVSS 9.1)
- [CVE-2023-29518](https://cve.now/CVE-2023-29518.md): Code injection from view right using Invitation.InvitationCommon in xwiki-platform (CVSS 9.9)
- [CVE-2023-29523](https://cve.now/CVE-2023-29523.md): Code injection in display method used in user profiles in xwiki-platform (CVSS 10.0)
- [CVE-2023-29524](https://cve.now/CVE-2023-29524.md): Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform (CVSS 10.0)
- [CVE-2023-29525](https://cve.now/CVE-2023-29525.md): Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform (CVSS 10.0)
- [CVE-2023-29526](https://cve.now/CVE-2023-29526.md): Async and display macro allow displaying and interacting with any document in restricted mode (CVSS 10.0)
- [CVE-2023-29527](https://cve.now/CVE-2023-29527.md): Code injection from account through AWM view sheet in xwiki platform (CVSS 10.0)
- [CVE-2023-29213](https://cve.now/CVE-2023-29213.md): org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability (CVSS 9.1)
- [CVE-2023-29511](https://cve.now/CVE-2023-29511.md): xwiki-platform-administration-ui vulnerable to privilege escalation (CVSS 9.9)
- [CVE-2023-30537](https://cve.now/CVE-2023-30537.md): org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation (CVSS 9.9)
- [CVE-2023-29509](https://cve.now/CVE-2023-29509.md): org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (CVSS 10.0)
- [CVE-2023-29508](https://cve.now/CVE-2023-29508.md): org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting (CVSS 8.9)
- [CVE-2023-29507](https://cve.now/CVE-2023-29507.md): org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors (CVSS 9.1)
- [CVE-2023-29506](https://cve.now/CVE-2023-29506.md): org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints (CVSS 5.4)
- [CVE-2023-29214](https://cve.now/CVE-2023-29214.md): org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (CVSS 10.0)
- [CVE-2023-29212](https://cve.now/CVE-2023-29212.md): xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (CVSS 10.0)
- [CVE-2023-29211](https://cve.now/CVE-2023-29211.md): org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability (CVSS 10.0)
- [CVE-2023-29210](https://cve.now/CVE-2023-29210.md): org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability (CVSS 10.0)
- [CVE-2023-29209](https://cve.now/CVE-2023-29209.md): org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability (CVSS 10.0)
- [CVE-2023-29208](https://cve.now/CVE-2023-29208.md): Data leak through deleted documents (CVSS 7.5)
- [CVE-2023-29207](https://cve.now/CVE-2023-29207.md): Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro (CVSS 8.9)
- [CVE-2023-29206](https://cve.now/CVE-2023-29206.md): org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins (CVSS 9.1)
- [CVE-2023-29205](https://cve.now/CVE-2023-29205.md): org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro (CVSS 10.0)
- [CVE-2023-29204](https://cve.now/CVE-2023-29204.md): URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore (CVSS 4.7)
- [CVE-2023-29203](https://cve.now/CVE-2023-29203.md): Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm (CVSS 3.7)
- [CVE-2023-29202](https://cve.now/CVE-2023-29202.md): org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability (CVSS 9.1)
- [CVE-2023-29201](https://cve.now/CVE-2023-29201.md): org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability (CVSS 9.1)
- [CVE-2023-27480](https://cve.now/CVE-2023-27480.md): Data leak through a XAR import XXE attack in xwiki-platform-xar-model (CVSS 7.7)
- [CVE-2023-27479](https://cve.now/CVE-2023-27479.md): Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui (CVSS 10.0)
- [CVE-2023-26055](https://cve.now/CVE-2023-26055.md): XWiki Commons may allow privilege escalation to programming rights via user's first name (CVSS 10.0)
- [CVE-2023-26056](https://cve.now/CVE-2023-26056.md): XWiki Platform allows macro execution as any user without programming rights through the context macro (CVSS 5.4)
- [CVE-2023-26470](https://cve.now/CVE-2023-26470.md): In XWiki Platform, saving a document with a large object number leads to persistent OOM errors (CVSS 5.7)
- [CVE-2023-26471](https://cve.now/CVE-2023-26471.md): XWiki Platform users may execute anything with superadmin right through comments and async macro (CVSS 10.0)
- [CVE-2023-26472](https://cve.now/CVE-2023-26472.md): XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile (CVSS 10.0)
- [CVE-2023-26473](https://cve.now/CVE-2023-26473.md): XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm (CVSS 6.5)
- [CVE-2023-26474](https://cve.now/CVE-2023-26474.md): XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author (CVSS 10.0)
- [CVE-2023-26475](https://cve.now/CVE-2023-26475.md): XWiki Platform vulnerable to Remote Code Execution in Annotations (CVSS 10.0)
- [CVE-2023-26476](https://cve.now/CVE-2023-26476.md): Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor (CVSS 7.5)
- [CVE-2023-26477](https://cve.now/CVE-2023-26477.md): org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (CVSS 10.0)
- [CVE-2023-26478](https://cve.now/CVE-2023-26478.md): org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function (CVSS 6.6)
- [CVE-2023-26479](https://cve.now/CVE-2023-26479.md): org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions (CVSS 6.5)
- [CVE-2023-26480](https://cve.now/CVE-2023-26480.md): XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data (CVSS 8.9)
- [CVE-2022-41935](https://cve.now/CVE-2022-41935.md): Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui (CVSS 5.3)
- [CVE-2022-41934](https://cve.now/CVE-2022-41934.md): Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui (CVSS 9.9)
- [CVE-2022-41933](https://cve.now/CVE-2022-41933.md): Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default (CVSS 6.2)
- [CVE-2022-41932](https://cve.now/CVE-2022-41932.md): Creation of new database tables through login form on PostgreSQL (CVSS 7.5)
- [CVE-2022-41931](https://cve.now/CVE-2022-41931.md): Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui (CVSS 9.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/xwiki
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.