XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-32730No CSRF protection on the password change form
- CVE-2021-32729A user without PR can reset user authentication failures information
- CVE-2021-32620Users registered with email verification can self re-activate their disabled accounts
- CVE-2021-32621Script injection without script or programming rights through Gadget titles
- CVE-2021-29459XSS Cross Site Scripting
- CVE-2021-21380Rating Script Service expose XWiki to SQL injection
- CVE-2021-21379It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro
- CVE-2020-15252RCE in XWiki
- CVE-2020-15171Users with SCRIPT rights can execute arbitrary code in XWiki
- CVE-2020-11057Code Injection in XWiki Platform