XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-36096XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
- CVE-2022-36095XWiki Cross-Site Request Forgery (CSRF) for actions on tags
- CVE-2022-36094XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
- CVE-2022-36093XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
- CVE-2022-36092XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
- CVE-2022-36091XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor
- CVE-2022-36090org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users
- CVE-2022-31166XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups
- CVE-2022-31167XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference
- CVE-2022-29258Cross-site Scripting in Filter Stream Converter Application in XWiki Platform
- CVE-2022-29251Cross-site Scripting in the Flamingo theme manager
- CVE-2022-29252Cross-site Scripting in XWiki Platform Wiki UI Main Wiki
- CVE-2022-29253Path Traversal in XWiki Platform
- CVE-2022-29161Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform
- CVE-2022-24897Arbitrary filesystem write access from Velocity
- CVE-2022-24898Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
- CVE-2022-24820Unauthenticated user can list hidden document from multiple velocity templates
- CVE-2022-24819Unauthenticated user can retrieve the list of users through uorgsuggest.vm
- CVE-2022-24821Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
- CVE-2022-23622Cross site scripting in registration template in xwiki-platform
- CVE-2022-23621Missing authorization in xwiki-platform
- CVE-2022-23620Path traversal in xwiki-platform-skin-skinx
- CVE-2022-23619Information exposure in xwiki-platform
- CVE-2022-23618Open Redirect in xwiki-platform
- CVE-2022-23617Missing authorization in xwiki-platform
- CVE-2022-23616Remote code execution in xwiki-platform
- CVE-2022-23615Partial authorization bypass on document save in xwiki-platform
- CVE-2021-43841XSS by SVG upload in xwiki-platform
- CVE-2021-32732Cross-Site Request Forgery in xwiki-platform
- CVE-2021-32731The reset password form reveal users email address