XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-29522Code injection from view right on XWiki.ClassSheet in xwiki-platform
- CVE-2023-29521Code injection from account/view through VFS Tree macro in xwiki-platform
- CVE-2023-29520Page render failure due to broken translations in xwiki-platform
- CVE-2023-29519Code injection in org.xwiki.platform:xwiki-platform-attachment-ui
- CVE-2023-29518Code injection from view right using Invitation.InvitationCommon in xwiki-platform
- CVE-2023-29523Code injection in display method used in user profiles in xwiki-platform
- CVE-2023-29524Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform
- CVE-2023-29525Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform
- CVE-2023-29526Async and display macro allow displaying and interacting with any document in restricted mode
- CVE-2023-29527Code injection from account through AWM view sheet in xwiki platform
- CVE-2023-29213org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability
- CVE-2023-29511xwiki-platform-administration-ui vulnerable to privilege escalation
- CVE-2023-30537org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation
- CVE-2023-29509org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
- CVE-2023-29508org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting
- CVE-2023-29507org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
- CVE-2023-29506org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
- CVE-2023-29214org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
- CVE-2023-29212xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
- CVE-2023-29211org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
- CVE-2023-29210org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
- CVE-2023-29209org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability
- CVE-2023-29208Data leak through deleted documents
- CVE-2023-29207Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
- CVE-2023-29206org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins
- CVE-2023-29205org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro
- CVE-2023-29204URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-29203Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm
- CVE-2023-29202org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability
- CVE-2023-29201org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability