XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-48240XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
- CVE-2023-46243Code execution via the edit action in XWiki platform
- CVE-2023-46242Code injection in XWiki Platform
- CVE-2023-46244Privilege escalation in Xwiki platform
- CVE-2023-46731Remote code execution through the section parameter in Administration as guest in XWiki Platform
- CVE-2023-46732Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform
- CVE-2023-45137XWiki Platform XSS with edit right in the create document form for existing pages
- CVE-2023-45136XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
- CVE-2023-45135XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
- CVE-2023-45134XWiki Platform XSS vulnerability from account in the create page form via template provider
- CVE-2023-37913org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
- CVE-2023-37912XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
- CVE-2023-37911org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents
- CVE-2023-37910org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move
- CVE-2023-37909Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
- CVE-2023-37908org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
- CVE-2023-41046Velocity execution without script rights in Xwiki platform
- CVE-2023-40573XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution
- CVE-2023-40572XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
- CVE-2023-40177XWiki Platform privilege escalation (PR) from account through AWM content fields
- CVE-2023-40176SXSS in the user profile via the timezone displayer
- CVE-2023-37914Privilege escalation (PR)/RCE from account through Invitation subject/message
- CVE-2023-38509XWiki Platform's obfuscated email addresses should not be sorted
- CVE-2023-37462Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui
- CVE-2023-37277XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
- CVE-2023-36477Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform
- CVE-2023-36468Upgrading doesn't prevent exploiting vulnerable XWiki documents
- CVE-2023-36469Code injection through NotificationRSSService in XWiki Platform
- CVE-2023-36470Code injection in icon themes of XWiki Platform
- CVE-2023-36471HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml