XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-35162XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template
- CVE-2023-35161XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page
- CVE-2023-35160XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
- CVE-2023-35159XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
- CVE-2023-35158XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template
- CVE-2023-35157XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
- CVE-2023-35156XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
- CVE-2023-35155XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email
- CVE-2023-35153XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
- CVE-2023-35152XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
- CVE-2023-35151XWiki Platform may show email addresses in clear in REST results
- CVE-2023-35150XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
- CVE-2023-34467XWiki Platform may retrieve email addresses of all users
- CVE-2023-34466XWiki Platform's tags on non-viewable pages can be revealed to users
- CVE-2023-34465XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
- CVE-2023-34464XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
- CVE-2023-35166Privilege escalation (PR) from account through TipsPanel
- CVE-2023-32068URL Redirection to Untrusted Site in XWiki
- CVE-2023-32070Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
- CVE-2023-32071XWiki Platform vulnerable to RXSS via editor parameter - importinline template
- CVE-2023-32069XWiki Platform privilege escalation (PR)/RCE from account through class sheet
- CVE-2023-31126Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
- CVE-2023-29528Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
- CVE-2023-29517Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer
- CVE-2023-29516Code injection from view right on XWiki.AttachmentSelector in xwiki-platform
- CVE-2023-29515Cross-site scripting (XSS) in xwiki-platform
- CVE-2023-29514Code injection in template provider administration in xwiki-platform
- CVE-2023-29513Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
- CVE-2023-29512Code injection in xwiki-platform-web-templates
- CVE-2023-29510Code injection via unescaped translations in xwiki-platform