XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-49584XWiki makes title of inaccessible pages available through the class property values REST API
- CVE-2025-49583XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
- CVE-2025-49582XWiki's required right warnings for macros are incomplete
- CVE-2025-49581XWiki allows remote code execution through default value of wiki macro wiki-type parameters
- CVE-2025-49580XWiki allows privilege escalation through link refactoring
- CVE-2024-56158XWiki allows SQL injection in query endpoint of REST API with Oracle
- CVE-2025-48063XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right
- CVE-2025-46554XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
- CVE-2025-46557Any user with view access to the XWiki space can change the authenticator
- CVE-2025-32973org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
- CVE-2025-32974org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
- CVE-2025-32972The lesscss script service allows cache clearing without programming right
- CVE-2025-32971XWiki Solr script service doesn't take dropped programming right into account
- CVE-2025-32970org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
- CVE-2025-32969org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
- CVE-2025-32968org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
- CVE-2025-32783XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki
- CVE-2025-29926The WikiManager REST API allows any user to create wikis
- CVE-2025-29925XWiki allows unregistered users to access private pages information through REST endpoint
- CVE-2025-29924XWiki uses the wrong wiki reference in AuthorizationManager
- CVE-2025-24893Remote code execution as guest via SolrSearchMacros request in xwiki
- CVE-2025-23025Privilege escalation (PR) through realtime WYSIWYG editing in XWiki
- CVE-2024-55879XWiki allows RCE from script right in configurable sections
- CVE-2024-55877XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-55876XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
- CVE-2024-55663XWiki Platform has an SQL injection in getdocuments.vm with sort parameter
- CVE-2024-55662XWiki allows remote code execution through the extension sheet
- CVE-2024-46978Missing checks for notification filter preferences editions in XWiki Platform
- CVE-2024-46979Data leak of notification filters of users in XWiki Platform
- CVE-2024-45591XWiki Platform document history including authors of any page exposed to unauthorized actors