Xwiki
256 CVEs across 24 Xwiki products. Browse Xwiki vulnerabilities, severities, and proof-of-concept exploits.
Xwiki products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48048 | High | 7.5 | 2026-08-10 | XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to v… |
CVE-2026-48047 | | 2026-08-07 | XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3… | |
CVE-2026-33137 | | 2026-05-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions… | |
CVE-2026-23734 | | 2026-05-20 | XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs… | |
CVE-2025-51846 | High | 7.5 | 2026-04-30 | CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a Crypt… |
CVE-2026-40105 | Medium | 6.1 | 2026-04-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, th… |
CVE-2026-40104 | High | 8.2 | 2026-04-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and pri… |
CVE-2026-33229 | Critical | 9.8 | 2026-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected s… |
CVE-2025-66024 | Critical | 9.0 | 2026-03-04 | The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable t… |
CVE-2026-26000 | Medium | 6.1 | 2026-02-12 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible u… |
CVE-2026-24128 | Medium | 6.1 | 2026-01-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1… |
CVE-2025-65091 | Critical | 10.0 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (i… |
CVE-2025-65090 | Medium | 5.3 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (… |
CVE-2025-66474 | High | 8.8 | 2025-12-10 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions… |
CVE-2025-66473 | High | 7.5 | 2025-12-10 | XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which… |
CVE-2025-66472 | Medium | 6.1 | 2025-12-10 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc… |
CVE-2025-65036 | High | 8.3 | 2025-12-05 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from t… |
CVE-2025-55749 | High | 7.5 | 2025-12-01 | XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a c… |
CVE-2025-65089 | Medium | 6.8 | 2025-11-19 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights… |
CVE-2025-52472 | | 2025-10-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versi… | |
CVE-2025-55728 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-55727 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-55748 | High | 7.5 | 2025-09-03 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configura… |
CVE-2025-55747 | Critical | 9.1 | 2025-09-03 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configur… |
CVE-2025-58049 | Medium | 5.8 | 2025-08-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1… |
CVE-2025-51991 | High | 8.8 | 2025-08-20 | XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info fie… |
CVE-2025-51990 | Medium | 4.8 | 2025-08-20 | XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the… |
CVE-2025-54125 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-54124 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-32430 | Medium | 6.1 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-… |
CVE-2025-54385 | Critical | 9.8 | 2025-07-26 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions… |
CVE-2025-32429 | Critical | 9.8 | 2025-07-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 t… |
CVE-2025-53836 | Critical | 9.9 | 2025-07-15 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting… |
CVE-2025-53835 | Critical | 9.0 | 2025-07-14 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting… |
CVE-2025-49591 | Critical | 9.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak… |
CVE-2025-49590 | Medium | 6.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripti… |
CVE-2025-49587 | High | 8.0 | 2025-06-13 | XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass… |
CVE-2025-49586 | High | 8.8 | 2025-06-13 | XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki)… |
CVE-2025-49585 | High | 8.0 | 2025-06-13 | XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or… |
CVE-2025-49584 | High | 7.5 | 2025-06-13 | XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page… |
CVE-2025-49583 | Low | 3.5 | 2025-06-13 | XWiki is a generic wiki platform. When a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object… |
CVE-2025-49582 | High | 8.0 | 2025-06-13 | XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer ri… |
CVE-2025-49581 | High | 8.8 | 2025-06-13 | XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming… |
CVE-2025-49580 | High | 8.0 | 2025-06-13 | XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a li… |
CVE-2024-56158 | Critical | 9.8 | 2025-06-12 | XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query val… |
CVE-2025-48063 | High | 8.8 | 2025-05-21 | XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security mo… |
CVE-2025-46558 | Critical | 9.0 | 2025-04-30 | XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to befor… |
CVE-2025-46557 | Critical | 9.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16… |
CVE-2025-46554 | Medium | 5.3 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and… |
CVE-2025-32974 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doe… |
CVE-2025-32973 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16… |
CVE-2025-32972 | Low | 2.7 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to befo… |
CVE-2025-32971 | Low | 3.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-… |
CVE-2025-32970 | Medium | 6.1 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16… |
CVE-2025-32969 | Critical | 9.8 | 2025-04-23 | XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to… |
CVE-2025-32968 | High | 8.8 | 2025-04-23 | XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT righ… |
CVE-2025-32783 | Medium | 4.7 | 2025-04-16 | XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as cl… |
CVE-2025-29926 | Critical | 9.8 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where th… |
CVE-2025-29925 | Medium | 5.3 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wik… |
CVE-2025-29924 | High | 7.5 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through… |
CVE-2025-27604 | High | 7.5 | 2025-03-07 | XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a g… |
CVE-2025-24893 | Critical | 9.8 | 2025-02-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution… |
CVE-2025-23025 | Critical | 9.0 | 2025-01-14 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **expe… |
CVE-2024-55879 | Critical | 9.1 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary rem… |
CVE-2024-55877 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perfor… |
CVE-2024-55876 | Medium | 5.4 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main w… |
CVE-2024-55663 | Critical | 9.8 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering o… |
CVE-2024-55662 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Reposito… |
CVE-2024-52300 | Critical | 9.0 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any… |
CVE-2024-52299 | High | 7.5 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in th… |
CVE-2024-52298 | High | 7.5 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my vie… |
CVE-2024-46979 | Medium | 5.3 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of… |
CVE-2024-46978 | Medium | 6.5 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notific… |
CVE-2024-45591 | Medium | 5.3 | 2024-09-10 | XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information… |
CVE-2024-43401 | Critical | 9.0 | 2024-08-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a us… |
CVE-2024-43400 | Critical | 9.0 | 2024-08-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programmin… |
CVE-2024-42489 | Critical | 10.0 | 2024-08-12 | Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit… |
CVE-2024-41947 | Critical | 9.0 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rig… |
CVE-2024-37901 | Critical | 9.9 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbit… |
CVE-2024-37900 | Medium | 6.4 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename… |
CVE-2024-37898 | Medium | 4.3 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in X… |
CVE-2024-38369 | Critical | 9.9 | 2024-06-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include re… |
CVE-2024-37899 | Critical | 9.0 | 2024-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's prof… |
CVE-2024-31997 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity co… |
CVE-2024-31996 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool… |
CVE-2024-31988 | Critical | 9.6 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, when the realtime editor is ins… |
CVE-2024-31987 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any… |
CVE-2024-31986 | Critical | 9.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special… |
CVE-2024-31985 | Medium | 5.4 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/un… |
CVE-2024-31984 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a sp… |
CVE-2024-31983 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are… |
CVE-2024-31982 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search a… |
CVE-2024-31981 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, remote code execution is possible v… |
CVE-2024-31465 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any… |
CVE-2024-31464 | Medium | 6.8 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the has… |
CVE-2024-26138 | Medium | 5.3 | 2024-02-21 | The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document `Licenses.Code.LicenseJSON` that prov… |
CVE-2024-21651 | High | 7.5 | 2024-01-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malf… |
CVE-2024-21648 | High | 8.0 | 2024-01-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a u… |
CVE-2024-21650 | Critical | 10.0 | 2024-01-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) a… |
CVE-2023-50732 | High | 8.3 | 2023-12-21 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without scr… |