XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-43400XWiki Platform allows XSS through XClass name in string properties
- CVE-2024-43401In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
- CVE-2024-41947XWiki Platform XSS through conflict resolution
- CVE-2024-37901XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
- CVE-2024-37900XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
- CVE-2024-37898XWiki Platform vulnerable to document deletion and overwrite from edit
- CVE-2024-38369XWiki programming rights may be inherited by inclusion
- CVE-2024-37899Disabling a user account changes its author, allowing RCE from user account in XWiki
- CVE-2024-31997XWiki Platform remote code execution from account through UIExtension parameters
- CVE-2024-31996XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
- CVE-2024-31988XWiki Platform CSRF remote code execution through the realtime HTML Converter API
- CVE-2024-31987XWiki Platform remote code execution from account via custom skins support
- CVE-2024-31986XWiki Platform CSRF remote code execution through scheduler job's document reference
- CVE-2024-31985XWiki Platform CSRF in the job scheduler
- CVE-2024-31984XWiki Platform: Remote code execution through space title and Solr space facet
- CVE-2024-31983XWiki Platform: Remote code execution from edit in multilingual wikis via translations
- CVE-2024-31982XWiki Platform: Remote code execution as guest via DatabaseSearch
- CVE-2024-31981XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
- CVE-2024-31465XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
- CVE-2024-31464XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted
- CVE-2024-21648XWiki has no right protection on rollback action
- CVE-2024-21651XWiki Denial of Service attack through attachments
- CVE-2024-21650XWiki Remote Code Execution vulnerability via user registration
- CVE-2023-50732Velocity execution without script right through tree macro
- CVE-2023-50723XWiki Platform remote code execution/programming rights with configuration section from any user account
- CVE-2023-50722XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
- CVE-2023-50721XWiki Platform RCE from account through SearchAdmin
- CVE-2023-50719XWiki Platform Solr search discloses password hashes of all users
- CVE-2023-50720XWiki Platform Solr search discloses email addresses of users
- CVE-2023-48241XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service