XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-27480Data leak through a XAR import XXE attack in xwiki-platform-xar-model
- CVE-2023-27479Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
- CVE-2023-26055XWiki Commons may allow privilege escalation to programming rights via user's first name
- CVE-2023-26056XWiki Platform allows macro execution as any user without programming rights through the context macro
- CVE-2023-26470In XWiki Platform, saving a document with a large object number leads to persistent OOM errors
- CVE-2023-26471XWiki Platform users may execute anything with superadmin right through comments and async macro
- CVE-2023-26472XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
- CVE-2023-26473XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm
- CVE-2023-26474XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
- CVE-2023-26475XWiki Platform vulnerable to Remote Code Execution in Annotations
- CVE-2023-26476Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor
- CVE-2023-26477org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
- CVE-2023-26478org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function
- CVE-2023-26479org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions
- CVE-2023-26480XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data
- CVE-2022-41935Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui
- CVE-2022-41934Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui
- CVE-2022-41933Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default
- CVE-2022-41932Creation of new database tables through login form on PostgreSQL
- CVE-2022-41931Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
- CVE-2022-41930org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users
- CVE-2022-41929Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-41928XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
- CVE-2022-41927XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags
- CVE-2022-41937Missing Authorization in XWiki Platform
- CVE-2022-41936Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server
- CVE-2022-36100XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
- CVE-2022-36098XWiki Platform Mentions UI vulnerable to Cross-site Scripting
- CVE-2022-36099XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
- CVE-2022-36097XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form