xwiki xwiki-platform
233 vulnérabilités publiées citent ce produit. Les 200 plus récentes sont listées.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-53966 | >= 13.4-rc-1, < 16.10.17 ; >= 17.0.0-rc-1, < 17.4.10 ; >= 17.5.0-rc-1, < 17.10.4 ; … | XWiki Platform: Privilege escalation from edit to script right through Live Data editing | HIGH 7.1 | 0.8 % | ||
| CVE-2026-34151 | < 17.10.5 ; >= 18.0.0-rc-1, < 18.2.0 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ | HIGH 8.2 | 1.1 % | ||
| CVE-2026-48048 | >= 6.2.1, < 16.10.17 ; >= 17.0.0-rc-1, < 17.4.9 ; >= 17.5.0-rc-1, < 17.10.3 | XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests | HIGH 7.5 | 2.0 % | ||
| CVE-2026-48047 | >= 9.6-rc-1, < 16.10.17 ; >= 17.0.0-rc-1, < 17.4.9 ; >= 17.5.0-rc-1, < 17.10.3 | XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin | MEDIUM 5.9 | 0.7 % | ||
| CVE-2026-33137 | >= 15.10.6, < 16.10.17 ; >= 17.0.0-rc-1, < 17.4.9 ; >= 17.5.0, < 17.10.3 ; … | XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-40105 | >= 10.4-rc-1, < 16.10.16 ; >= 17.0.0-rc-1, < 17.4.8 ; >= 17.5.0-rc-1, < 17.10.1 | XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-33229 | >= 17.0.0-rc-1, < 17.4.8 ; >= 17.5.0-rc-1, < 17.10.1 | XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API | HIGH 8.6 | 0.5 % | ||
| CVE-2026-26000 | >= 17.5.0, < 17.9.0 ; >= 17.0.0-rc-1, < 17.4.6 ; < 16.10.13 | XWiki Platform affected by click-jacking through CSS injection in comments | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-24128 | >= 7.0-milestone-2, < 16.10.12 ; >= 17.0.0-rc-1, < 17.4.5 ; >= 17.5.0-rc-1, < 17.8.0-rc-1 | XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-66473 | < 16.10.11 ; >= 17.0.0-rc-1, < 17.4.4 ; >= 17.5.0-rc-1, < 17.7.0-rc-1 | XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis | HIGH 8.7 | 0.4 % | ||
| CVE-2025-66472 | org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 6.2-milestone-1, < 16.10.10 ; org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 17.0.0-rc-1, < 17.4.2 ; org.xwiki.platform:xwiki-platform-web-templates >= 6.2-milestone-1, < 16.10.10 ; … | XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-55749 | >= 16.7.0, < 16.10.11 ; >= 17.0.0-rc1, < 17.4.4 ; >= 17.5.0, < 17.7.0 | The XWiki Jetty package (XJetty) allows accessing any application file through URL | HIGH 8.7 | 1.5 % | ||
| CVE-2025-52472 | >= 4.3-milestone-1, < 16.10.9 ; >= 17.0.0-rc-1, < 17.4.2 | XWiki Platform vulnerable to HQL injection via wiki and space search REST API | CRITICAL 9.3 | 2.4 % | ||
| CVE-2025-55748 | >= 4.2-milestone-2, < 16.10.7 | XWiki Platform's configuration files can be accessed through jsx and sx endpoints | CRITICAL 9.3 | 1.8 % | ||
| CVE-2025-55747 | >= 6.1-milestone-2, < 16.10.7 | XWiki Platform's configuration files can be accessed through the webjars API | CRITICAL 9.3 | 1.7 % | ||
| CVE-2025-58049 | >= 14.4.2, < 16.4.8 ; >= 16.5.0-rc-1, < 16.10.7 ; >= 17.0.0-rc-1, < 17.4.0-rc-1 | XWiki PDF export jobs store sensitive cookies unencrypted in job statuses | HIGH 7.5 | 0.4 % | ||
| CVE-2025-54125 | >= 1.1, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.5 ; >= 17.0.0-rc-1, < 17.2.0-rc-1 | XWiki Platform: Password and email exposure in xml.vm fields | HIGH 8.7 | 1.5 % | ||
| CVE-2025-54124 | >= 9.8-rc-1, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.5 ; >= 17.0.0-rc-1, < 17.2.0-rc-1 | XWiki Platform: Any user with editing rights can access password properties through Database List Properties | HIGH 7.1 | 0.5 % | ||
| CVE-2025-32430 | >= 4.2-milestone-3, < 16.4.8 ; >= 16.5.0-rc-1, < 16.10.6 ; >= 17.0.0-rc-1, < 17.3.0-rc-1 | XWiki Platform contains Reflected XSS vulnerability in two templates | MEDIUM 6.5 | 0.7 % | ||
| CVE-2025-54385 | < 16.10.6 ; >= 17.0.0-rc1, < 17.3.0-rc-1 | XWiki Platform's searchDocuments API allows for SQL injection | HIGH 8.6 | 0.7 % | ||
| CVE-2025-32429 | >= 9.4-rc-1, < 16.10.6 ; >= 17.0.0-rc-1, < 17.3.0-rc-1 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter | CRITICAL 9.3 | 85 % | ||
| CVE-2025-49587 | >= 15.9-rc-1, < 15.10.16 ; >= 16.0.0-rc-1, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.2 | XWiki does not require right warnings for notification displayer objects | MEDIUM 6.4 | 0.4 % | ||
| CVE-2025-49586 | >= 7.2-milestone-2, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.3 ; >= 17.0.0-rc-1, < 17.0.0 | XWiki allows remote code execution through preview of XClass changes in AWM editor | HIGH 8.7 | 0.7 % | ||
| CVE-2025-49585 | < 15.10.16 ; >= 16.0.0-rc-1, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.2 | XWiki does not require right warnings for XClass definitions | HIGH 8.6 | 0.4 % | ||
| CVE-2025-49584 | >= 10.9, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.3 ; >= 17.0.0-rc-1, < 17.0.0 | XWiki makes title of inaccessible pages available through the class property values REST API | HIGH 8.7 | 0.4 % | ||
| CVE-2025-49583 | < 15.10.16 ; >= 16.0.0-rc-1, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.2 | XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right | MEDIUM 5.1 | 0.3 % | ||
| CVE-2025-49582 | >= 15.9-rc-1, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.3 ; >= 17.0.0-rc-1, < 17.0.0 | XWiki's required right warnings for macros are incomplete | HIGH 8.6 | 0.9 % | ||
| CVE-2025-49581 | >= 11.10.11, < 12.0 ; >= 12.6.3, < 12.7 ; >= 12.8-rc-1, < 16.4.7 ; … | XWiki allows remote code execution through default value of wiki macro wiki-type parameters | HIGH 8.7 | 0.6 % | ||
| CVE-2025-49580 | >= 17.0.0-rc-1, < 17.1.0-rc-1 ; >= 16.5.0-rc-1, < 16.10.4 ; >= 8.2, < 16.4.7 ; … | XWiki allows privilege escalation through link refactoring | HIGH 8.5 | 0.5 % | ||
| CVE-2024-56158 | >= 1.0, < 15.10.16 ; >= 16.0.0-rc-1, < 16.4.7 ; >= 16.5.0-rc-1, < 16.10.2 | XWiki allows SQL injection in query endpoint of REST API with Oracle | CRITICAL 9.3 | 0.5 % | ||
| CVE-2025-48063 | >= 16.10.0-rc-1, < 16.10.4 ; >= 17.0.0-rc-1, < 17.1.0-rc-1 | XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right | MEDIUM 4.8 | 1.0 % | ||
| CVE-2025-46554 | >= 1.8.1, < 14.10.22 ; >= 15.0-rc-1, < 15.10.12 ; >= 16.0.0-rc-1, < 16.4.3 ; … | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API | MEDIUM 5.3 | 1.0 % | ||
| CVE-2025-46557 | >= 15.3-rc-1, < 15.10.14 ; >= 16.0.0-rc-1, < 16.4.6 ; >= 16.5.0-rc-1, < 16.10.0-rc-1 | Any user with view access to the XWiki space can change the authenticator | HIGH 8.4 | 0.6 % | ||
| CVE-2025-32973 | >= 15.9-rc-1, < 15.10.12 ; >= 16.0.0-rc-1, < 16.4.3 ; >= 16.5.0-rc-1, < 16.8.0-rc-1 | org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-32974 | >= 15.9-rc-1, < 15.10.8 ; >= 16.0.0-rc-1, < 16.2.0 | org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default conten… | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-32972 | >= 6.1-milestone-1, < 15.10.12 ; >= 16.0.0-rc-1, < 16.4.3 ; >= 16.5.0-rc-1, < 16.8.0-rc-1 | The lesscss script service allows cache clearing without programming right | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-32971 | >= 4.5.1, < 15.10.13 ; >= 16.0.0-rc-1, < 16.4.4 ; >= 16.5.0-rc-1, < 16.8.0-rc-1 | XWiki Solr script service doesn't take dropped programming right into account | LOW 3.8 | 0.4 % | ||
| CVE-2025-32970 | >= 13.5-rc-1, < 15.10.13 ; >= 16.0.0-rc-1, < 16.4.4 ; >= 16.5.0-rc-1, < 16.8.0 | org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability | MEDIUM 6.1 | 0.6 % | ||
| CVE-2025-32969 | >= 1.8, < 15.10.16 ; >= 16.0.0-rc-1, < 16.4.6 ; >= 16.5.0-rc-1, < 16.10.1 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API | CRITICAL 9.3 | 80 % | ||
| CVE-2025-32968 | >= 1.6-milestone-1, < 15.10.16 ; >= 16.0.0-rc-1, < 16.4.6 ; >= 16.5.0-rc-1, < 16.10.1 | org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API | HIGH 8.6 | 0.6 % | ||
| CVE-2025-32783 | >= 5.0, <= 16.7.1 | XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki | MEDIUM 4.7 | 0.3 % | ||
| CVE-2025-29926 | >= 5.4-rc-1, < 15.10.15 ; >= 16.0.0-rc-1, < 16.4.6 ; >= 16.5.0-rc-1, < 16.10.0 | The WikiManager REST API allows any user to create wikis | HIGH 7.9 | 0.6 % | ||
| CVE-2025-29925 | >= 1.9M1, < 15.10.14 ; >= 16.0.0-rc-1, < 16.4.6 ; >= 16.5.0-rc-1, < 16.10.0-rc-1 | XWiki allows unregistered users to access private pages information through REST endpoint | HIGH 8.7 | 0.9 % | ||
| CVE-2025-29924 | >= 6.1-rc-1, < 15.10.14 ; >= 16.0.0-rc-1, < 16.4.6 ; >= 16.5.0-rc-1, < 16.10.0-rc-1 | XWiki uses the wrong wiki reference in AuthorizationManager | HIGH 8.7 | 0.4 % | ||
| CVE-2025-24893 | >= 5.3-milestone-2, < 15.10.11 ; >= 16.0.0-rc-1, < 16.4.1 | Remote code execution as guest via SolrSearchMacros request in xwiki | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2025-23025 | >= 13.9-rc-1, < 15.10.12 ; >= 16.0.0, < 16.4.1 ; >= 16.5.0, < 16.6.0-rc-1 | Privilege escalation (PR) through realtime WYSIWYG editing in XWiki | CRITICAL 9.1 | 0.4 % | ||
| CVE-2024-55879 | >= 2.3, < 15.10.9 ; >= 16.0.0-rc-1, < 16.3.0 | XWiki allows RCE from script right in configurable sections | CRITICAL 9.1 | 1.1 % | ||
| CVE-2024-55877 | >= 9.7-rc-1, < 15.10.11 ; >= 16.0.0-rc-1, < 16.4.1 ; >= 16.5.0-rc-1, < 16.5.0 | XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList | CRITICAL 10.0 | 1.6 % | ||
| CVE-2024-55876 | >= 1.2-milestone-2, < 15.10.9 ; >= 16.0.0-rc-1, < 16.3.0 | XWiki's scheduler in subwiki allows scheduling operations for any main wiki user | MEDIUM 5.4 | 0.6 % | ||
| CVE-2024-55663 | >= 6.3-milestone-2, < 13.10.5 ; >= 14.0-rc-1, < 14.3-rc-1 | XWiki Platform has an SQL injection in getdocuments.vm with sort parameter | HIGH 8.6 | 0.8 % | ||
| CVE-2024-55662 | >= 3.3-milestone-1, < 15.10.9 ; >= 16.0.0-rc-1, < 16.3.0 | XWiki allows remote code execution through the extension sheet | CRITICAL 10.0 | 0.8 % | ||
| CVE-2024-46978 | >= 13.2-rc-1, < 14.10.21 ; >= 15.0.0, < 15.5.5 ; >= 15.6.0, < 15.10.1 | Missing checks for notification filter preferences editions in XWiki Platform | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-46979 | >= 13.2-rc-1, < 14.10.21 ; >= 15.0.0, < 15.5.5 ; >= 15.6.0, < 15.10.1 | Data leak of notification filters of users in XWiki Platform | MEDIUM 5.3 | 0.5 % | ||
| CVE-2024-45591 | >= 1.8.0, < 15.10.9 ; >= 16.0.0-rc-1, < 16.3.0-rc-1 | XWiki Platform document history including authors of any page exposed to unauthorized actors | MEDIUM 5.3 | 3.4 % | ||
| CVE-2024-43400 | >= 15.6-rc-1, < 15.10.2 ; >= 15.0-rc-1, < 15.5.5 ; < 14.10.21 ; … | XWiki Platform allows XSS through XClass name in string properties | CRITICAL 9.1 | 0.5 % | ||
| CVE-2024-43401 | < 15.10-rc-1 | In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them | CRITICAL 9.1 | 0.7 % | ||
| CVE-2024-41947 | >= 11.8-rc-1, < 15.10.8 ; >= 16.0.0-rc-1, < 16.3.0-rc-1 | XWiki Platform XSS through conflict resolution | CRITICAL 9.1 | 1.7 % | ||
| CVE-2024-37901 | >= 15.6-rc-1, < 15.10.2 ; >= 15.0-rc-1, < 15.5.5 ; >= 9.2-rc-1, < 14.10.21 | XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet | CRITICAL 10.0 | 1.1 % | ||
| CVE-2024-37900 | >= 4.2-milestone-3, < 14.10.21 ; >= 15.0-rc-1, < 15.5.5 ; >= 15.6-rc-1, < 15.10.6 ; … | XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader | MEDIUM 6.4 | 16 % | ||
| CVE-2024-37898 | >= 13.10.4, < 14.0-rc-1 ; >= 14.2, < 14.10.21 ; >= 15.0, < 15.5.5 ; … | XWiki Platform vulnerable to document deletion and overwrite from edit | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-38369 | >= 1.5-milestone-2, < 15.0-rc-1 | XWiki programming rights may be inherited by inclusion | CRITICAL 10.0 | 0.3 % | ||
| CVE-2024-37899 | >= 13.4.7, <= 13.5 ; >= 13.10.3, < 14.10.21 ; >= 15.0-rc-1, < 15.5.5 ; … | Disabling a user account changes its author, allowing RCE from user account in XWiki | CRITICAL 9.1 | 0.7 % | ||
| CVE-2024-31997 | < 14.10.19 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.9-rc-1 | XWiki Platform remote code execution from account through UIExtension parameters | CRITICAL 10.0 | 74 % | ||
| CVE-2024-31988 | >= 13.9-rc-1, < 14.10.19 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.9 | XWiki Platform CSRF remote code execution through the realtime HTML Converter API | CRITICAL 9.7 | 0.7 % | ||
| CVE-2024-31987 | >= 6.4-milestone-1, < 14.10.19 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.10-rc-1 | XWiki Platform remote code execution from account via custom skins support | CRITICAL 10.0 | 1.4 % | ||
| CVE-2024-31986 | >= 3.1, < 14.10.19 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.9 | XWiki Platform CSRF remote code execution through scheduler job's document reference | CRITICAL 9.1 | 0.5 % | ||
| CVE-2024-31985 | >= 3.1, < 14.10.19 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.9 | XWiki Platform CSRF in the job scheduler | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-31984 | >= 7.2-rc-1, < 14.10.20 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.10-rc-1 | XWiki Platform: Remote code execution through space title and Solr space facet | CRITICAL 10.0 | 83 % | ||
| CVE-2024-31983 | >= 4.3-milestone-2, < 14.10.20 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.10-rc-1 | XWiki Platform: Remote code execution from edit in multilingual wikis via translations | CRITICAL 10.0 | 1.4 % | ||
| CVE-2024-31982 | >= 2.4-milestone-1, < 14.10.20 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.10-rc-1 | XWiki Platform: Remote code execution as guest via DatabaseSearch | CRITICAL 10.0 | 35 % | ||
| CVE-2024-31981 | >= 3.0.1, < 14.10.20 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.10-rc-1 | XWiki Platform: Privilege escalation (PR) from user registration through PDFClass | CRITICAL 10.0 | 1.4 % | ||
| CVE-2024-31465 | >= 5.2-milestone-2, < 14.10.20 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.10-rc-1 | XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet | CRITICAL 10.0 | 76 % | ||
| CVE-2024-31464 | >= 5.0-rc-1, < 14.10.19 ; >= 15.0-rc-1, < 15.5.4 ; >= 15.6-rc-1, < 15.9-rc-1 | XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted | MEDIUM 6.8 | 0.4 % | ||
| CVE-2024-21648 | >= 1.0, < 14.10.17 ; >= 15.0-rc-1, < 15.5.3 ; >= 15.6-rc-1, < 15.8-rc-1 | XWiki has no right protection on rollback action | HIGH 8.8 | 0.5 % | ||
| CVE-2024-21651 | >= 14.10, < 14.10.18 ; >= 15.0-rc-1, < 15.5.3 ; >= 15.6-rc-1, < 15.8-rc-1 | XWiki Denial of Service attack through attachments | HIGH 7.5 | 0.6 % | ||
| CVE-2024-21650 | >= 2.2, < 14.10.17 ; >= 15.0-rc-1, < 15.5.3 ; >= 15.6-rc-1, < 15.8-rc-1 | XWiki Remote Code Execution vulnerability via user registration | CRITICAL 10.0 | 93 % | ||
| CVE-2023-50732 | >= 8.3-rc-1, < 14.10.7 ; >= 15.0-rc-1, < 15.2-rc-1 | Velocity execution without script right through tree macro | HIGH 8.3 | 0.5 % | ||
| CVE-2023-50723 | >= 2.3, < 14.10.15 ; >= 15.0-rc-1, < 15.5.2 ; >= 15.6-rc-1, < 15.7-rc-1 | XWiki Platform remote code execution/programming rights with configuration section from any user account | CRITICAL 10.0 | 1.2 % | ||
| CVE-2023-50722 | >= 2.3, < 14.10.15 ; >= 15.0-rc-1, < 15.5.2 ; >= 15.6-rc-1, < 15.7-rc-1 | XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass | CRITICAL 9.7 | 0.7 % | ||
| CVE-2023-50721 | >= 4.5-rc-1, < 14.10.15 ; >= 15.0-rc-1, < 15.5.2 ; >= 15.6-rc-1, < 15.7-rc-1 | XWiki Platform RCE from account through SearchAdmin | CRITICAL 10.0 | 79 % | ||
| CVE-2023-50719 | >= 7.2-milestone-2, < 14.10.15 ; >= 15.0-rc-1, < 15.5.2 ; >= 15.6-rc-1, < 15.7-rc-1 | XWiki Platform Solr search discloses password hashes of all users | HIGH 7.5 | 84 % | ||
| CVE-2023-50720 | < 14.10.15 ; >= 15.0-rc-1, < 15.5.2 ; >= 15.6-rc-1, < 15.7-rc-1 | XWiki Platform Solr search discloses email addresses of users | MEDIUM 5.3 | 59 % | ||
| CVE-2023-48241 | >= 6.3-milestone-2, < 14.10.15 ; >= 15.0-rc-1, < 15.5.1 | XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service | HIGH 7.5 | 73 % | ||
| CVE-2023-48240 | >= 11.10.1, < 14.10.15 ; >= 15.0-rc-1, < 15.5.1 ; >= 15.6-rc-1, < 15.6 | XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery | CRITICAL 9.1 | 0.7 % | ||
| CVE-2023-46243 | >= 1.0, < 14.10.6 | Code execution via the edit action in XWiki platform | CRITICAL 10.0 | 1.0 % | ||
| CVE-2023-46242 | >= 1.0, < 14.10.7 | Code injection in XWiki Platform | CRITICAL 9.7 | 0.4 % | ||
| CVE-2023-46244 | >= 3.2-milestone-3, < 14.10.7 | Privilege escalation in Xwiki platform | CRITICAL 9.1 | 0.8 % | ||
| CVE-2023-46731 | org.xwiki.platform:xwiki-platform-administration : < 14.10.14 ; org.xwiki.platform:xwiki-platform-administration-ui: < 14.10.14 ; org.xwiki.platform:xwiki-platform-administration-ui: >= 15.0-rc-1, < 15.5.1 | Remote code execution through the section parameter in Administration as guest in XWiki Platform | CRITICAL 10.0 | 89 % | ||
| CVE-2023-46732 | >= 9.7-rc-1, < 14.10.14 ; >= 15.0-rc-1, < 15.5.1 | Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform | CRITICAL 9.7 | 2.2 % | ||
| CVE-2023-45137 | >= 3.1-milestone-2, < 13.4-rc-1 ; >= 14.0-rc-1, < 14.10.12 ; >= 15.0-rc-1, < 15.5-rc-1 | XWiki Platform XSS with edit right in the create document form for existing pages | CRITICAL 9.1 | 0.8 % | ||
| CVE-2023-45136 | >= 12.0-rc-1, < 14.10.12 ; >= 15.0-rc-1, < 15.5-rc-1 | XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled | CRITICAL 9.7 | 5.4 % | ||
| CVE-2023-45135 | >= 7.2-milestone-2, < 14.10.12 ; >= 15.0-rc-1, < 15.5-rc-1 | XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title | CRITICAL 9.1 | 1.9 % | ||
| CVE-2023-45134 | >= 3.1-milestone-1, < 13.4-rc-1 ; >= 2.4-milestone-2, < 3.1-milestone-1 ; >= 14.0-rc-1, < 14.10.12 ; … | XWiki Platform XSS vulnerability from account in the create page form via template provider | CRITICAL 9.1 | 2.0 % | ||
| CVE-2023-37913 | >= 3.5-milestone-1, < 14.10.8 ; >= 15.0-rc-1, < 15.3-rc-1 | org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter | CRITICAL 10.0 | 1.4 % | ||
| CVE-2023-37911 | >= 9.4-rc-1, < 14.10.8 ; >= 15.0-rc-1, < 15.3-rc-1 | org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-37910 | >= 14.0-rc-1, < 14.4.8 ; >= 14.5, < 14.10.4 | org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move | HIGH 8.1 | 0.7 % | ||
| CVE-2023-37909 | >= 5.1-rc-1, < 14.10.8 ; >= 15.0-rc-1, < 15.3-rc-1 | Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet | CRITICAL 10.0 | 1.9 % | ||
| CVE-2023-41046 | >= 7.2, < 14.10.10 ; >= 15.0-rc-1, < 15.4-rc-1 | Velocity execution without script rights in Xwiki platform | MEDIUM 6.3 | 0.5 % | ||
| CVE-2023-40573 | < 14.10.9 ; >= 1.3 ; >= 15.0-rc-1, < 15.4-rc-1 | XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution | CRITICAL 9.1 | 1.1 % | ||
| CVE-2023-40572 | >= 3.2-milestone-3, < 14.10.9 ; >= 15.0-rc-1, < 15.4-rc-1 | XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action | CRITICAL 9.1 | 0.6 % | ||
| CVE-2023-40177 | >= 4.3-milestone-2, < 14.10.5 | XWiki Platform privilege escalation (PR) from account through AWM content fields | CRITICAL 9.9 | 1.1 % | ||
| CVE-2023-40176 | >= 4.1-milestone-2, < 14.10.5 | SXSS in the user profile via the timezone displayer | CRITICAL 9.1 | 80 % | ||
| CVE-2023-37914 | >= 2.5-m1, < 14.4.8 ; >= 14.5.0, < 14.10.6 ; >= 15.0, < 15.2-rc-1 | Privilege escalation (PR)/RCE from account through Invitation subject/message | CRITICAL 9.9 | 1.9 % | ||
| CVE-2023-38509 | >= 3.5-milestone-1, < 14.10.9 ; >= 15.0, < 15.3-rc-1 | XWiki Platform's obfuscated email addresses should not be sorted | MEDIUM 4.3 | 0.8 % | ||
| CVE-2023-37462 | >= 7.0-rc-1, < 14.4.8 ; >= 14.5, < 14.10.4 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui | CRITICAL 10.0 | 92 % | ||
| CVE-2023-37277 | >= 1.8, < 14.10.8 ; >= 15.0-rc-1, < 15.2 | XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API | CRITICAL 9.7 | 0.7 % | ||
| CVE-2023-36477 | org.xwiki.contrib:application-ckeditor-ui: >= 1.9, < 1.64.9 ; org.xwiki.platform:xwiki-platform-ckeditor-ui: >= 14.6-rc-1, < 14.10.6 ; org.xwiki.platform:xwiki-platform-ckeditor-ui: >= 15.0, < 15.1 | Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform | CRITICAL 9.1 | 0.9 % | ||
| CVE-2023-36468 | >= 2.0, < 14.10.7 ; >= 15.0-rc-1, < 15.2-rc-1 | Upgrading doesn't prevent exploiting vulnerable XWiki documents | CRITICAL 10.0 | 1.9 % | ||
| CVE-2023-36469 | >= 9.6-rc-1, < 14.10.6 ; >= 15.0-rc-1, < 15.2-rc-1 | Code injection through NotificationRSSService in XWiki Platform | CRITICAL 10.0 | 82 % | ||
| CVE-2023-36470 | >= 6.2-milestone-1, < 14.10.6 | Code injection in icon themes of XWiki Platform | CRITICAL 10.0 | 1.9 % | ||
| CVE-2023-35162 | >= 6.1-rc-1, < 14.10.5 ; >= 15.0-rc-1, < 15.1-rc-1 | XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template | CRITICAL 9.7 | 2.4 % | ||
| CVE-2023-35161 | >= 6.2-milestone-1, < 14.10.5 ; >= 15.0-rc-1, < 15.1-rc-1 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page | CRITICAL 9.7 | 2.4 % | ||
| CVE-2023-35160 | >= 2.5-milestone-2, < 14.10.5 ; >= 15.0-rc-1, < 15.1-rc-1 | XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template | CRITICAL 9.7 | 2.3 % | ||
| CVE-2023-35159 | >= 3.4-milestone-1, < 14.10.5 ; >= 15.0-rc-1, < 15.1-rc-1 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template | CRITICAL 9.7 | 2.2 % | ||
| CVE-2023-35158 | >= 9.4-rc-1, < 14.10.5 ; >= 15.0-rc-1, < 15.1-rc-1 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template | CRITICAL 9.7 | 2.0 % | ||
| CVE-2023-35157 | >= 3.2-milestone-3, < 14.10.6 ; >= 15.0-rc-0, < 15.1-rc-1 | XWiki Platform vulnerable to reflected cross-site scripting via delattachment action | HIGH 8.5 | 0.6 % | ||
| CVE-2023-35156 | >= 6.0-rc-1, < 14.10.6 ; >= 15.0-rc-0, < 15.1 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template | CRITICAL 9.7 | 2.1 % | ||
| CVE-2023-35155 | >= 2.6-rc-2, < 14.4.8 ; >= 14.5, < 14.10.4 | XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email | HIGH 8.8 | 1.5 % | ||
| CVE-2023-35153 | >= 5.4.4, < 14.4.8 ; >= 14.5, < 14.10.4 ; >= 15.0-rc-1, < 15.0 | XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters | CRITICAL 9.1 | 0.7 % | ||
| CVE-2023-35152 | >= 12.9-rc-1, < 14.4.8 ; >= 14.5, < 14.10.6 ; >= 15.0-rc-1, < 15.1 | XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults | CRITICAL 10.0 | 1.0 % | ||
| CVE-2023-35151 | >= 7.3-milestone-1, < 14.4.8 ; >= 14.5, < 14.10.6 ; >= 15.0-rc-1, < 15.1 | XWiki Platform may show email addresses in clear in REST results | HIGH 7.5 | 0.7 % | ||
| CVE-2023-35150 | >= 2.4-m-2, < 14.4.8 ; >= 14.5, < 14.10.4 | XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application | CRITICAL 9.9 | 78 % | ||
| CVE-2023-34467 | >= 3.5-milestone-1, < 14.4.8 ; >= 14.5, < 14.10.4 | XWiki Platform may retrieve email addresses of all users | HIGH 7.5 | 1.0 % | ||
| CVE-2023-34466 | >= 5.0-milestone-1, < 14.4.8 ; >= 14.5, < 14.10.4 | XWiki Platform's tags on non-viewable pages can be revealed to users | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-34465 | >= 11.8-rc-1, < 14.4.8 ; >= 14.5, < 14.10.6 ; >= 15.0-rc-1, < 15.1 | XWiki Platform's Mail.MailConfig can be edited by any user with edit rights | CRITICAL 10.0 | 0.9 % | ||
| CVE-2023-34464 | org.xwiki.platform:xwiki-platform-web >= 2.2.1, < 14.4.8 ; org.xwiki.platform:xwiki-platform-web-templates < 14.4.8 ; org.xwiki.platform:xwiki-platform-web-templates >= 14.5, < 14.10.5 ; … | XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template | CRITICAL 9.1 | 0.7 % | ||
| CVE-2023-35166 | >= 8.1-milestone-1, < 14.10.5 ; >= 15.0-rc-1, < 15.1-rc-1 | Privilege escalation (PR) from account through TipsPanel | CRITICAL 10.0 | 62 % | ||
| CVE-2023-32068 | < 14.10.4 | URL Redirection to Untrusted Site in XWiki | MEDIUM 6.1 | 55 % | ||
| CVE-2023-32071 | >= 2.2-milestone-1, < 14.4.8 ; >= 14.5, < 14.10.4 | XWiki Platform vulnerable to RXSS via editor parameter - importinline template | CRITICAL 9.1 | 70 % | ||
| CVE-2023-32069 | >= 3.3-milestone-3, < 14.10.4 | XWiki Platform privilege escalation (PR)/RCE from account through class sheet | CRITICAL 10.0 | 0.8 % | ||
| CVE-2023-29517 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.1 | Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer | HIGH 7.5 | 1.0 % | ||
| CVE-2023-29516 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.1 | Code injection from view right on XWiki.AttachmentSelector in xwiki-platform | CRITICAL 9.9 | 66 % | ||
| CVE-2023-29515 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.1 | Cross-site scripting (XSS) in xwiki-platform | HIGH 7.7 | 0.6 % | ||
| CVE-2023-29514 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.1 | Code injection in template provider administration in xwiki-platform | CRITICAL 10.0 | 1.9 % | ||
| CVE-2023-29513 | < 14.10.1 | Users can be created even when registration is disabled without validation via the template macro in xwiki-platform | MEDIUM 5.0 | 0.7 % | ||
| CVE-2023-29512 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.1 | Code injection in xwiki-platform-web-templates | CRITICAL 9.9 | 1.1 % | ||
| CVE-2023-29510 | < 14.10.2 | Code injection via unescaped translations in xwiki-platform | CRITICAL 10.0 | 1.9 % | ||
| CVE-2023-29522 | < 14.4.8 ; >= 14.5.0, < 14.10.3 | Code injection from view right on XWiki.ClassSheet in xwiki-platform | CRITICAL 9.9 | 1.9 % | ||
| CVE-2023-29521 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.2 | Code injection from account/view through VFS Tree macro in xwiki-platform | HIGH 8.8 | 1.1 % | ||
| CVE-2023-29520 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.1 | Page render failure due to broken translations in xwiki-platform | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-29519 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.2 | Code injection in org.xwiki.platform:xwiki-platform-attachment-ui | CRITICAL 9.1 | 1.9 % | ||
| CVE-2023-29518 | < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.1 | Code injection from view right using Invitation.InvitationCommon in xwiki-platform | CRITICAL 9.9 | 1.1 % | ||
| CVE-2023-29523 | >= 3.3-milestone-1, < 13.10.11 ; >= 14.0-rc-1, < 14.4.8 ; >= 14.5, < 14.10.1 | Code injection in display method used in user profiles in xwiki-platform | CRITICAL 10.0 | 2.0 % | ||
| CVE-2023-29524 | < 14.10.3 | Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform | CRITICAL 10.0 | 76 % | ||
| CVE-2023-29525 | < 14.4.8 ; >= 14.5.0, < 14.10.3. | Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform | CRITICAL 10.0 | 78 % | ||
| CVE-2023-29526 | >= 10.11.1, < 13.10.11 ; >= 14.0.0, < 14.4.8 ; >= 14.5.0, < 14.10.3 | Async and display macro allow displaying and interacting with any document in restricted mode | CRITICAL 10.0 | 1.1 % | ||
| CVE-2023-29527 | >= 7.4.4, < 14.10.3 | Code injection from account through AWM view sheet in xwiki platform | CRITICAL 10.0 | 1.1 % | ||
| CVE-2023-29213 | >= 4.2-milestone-3, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability | CRITICAL 9.1 | 0.4 % | ||
| CVE-2023-29511 | >= 14.0-rc-1, < 14.4.8 ; >= 14.5, < 14.10.1 ; >= 1.5M2, < 13.10.11 | xwiki-platform-administration-ui vulnerable to privilege escalation | CRITICAL 9.9 | 1.0 % | ||
| CVE-2023-30537 | >= 12.6.6, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation | CRITICAL 9.9 | 1.0 % | ||
| CVE-2023-29509 | >= 7.2-rc-1, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability | CRITICAL 10.0 | 76 % | ||
| CVE-2023-29508 | >= 13.10.10, < 13.10.11 ; >= 14.4, < 14.4.7 ; >= 14.9, < 14.10 | org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting | HIGH 8.9 | 0.4 % | ||
| CVE-2023-29507 | >= 14.5, < 14.10 ; >= 14.4.1, < 14.4.7 | org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors | CRITICAL 9.1 | 0.9 % | ||
| CVE-2023-29506 | >= 13.10.8, < 13.10.11 ; >= 14.4.3, < 14.4.7 ; >= 14.6, < 14.10 | org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints | MEDIUM 6.1 | 1.7 % | ||
| CVE-2023-29214 | >= 1.1-M2, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability | CRITICAL 10.0 | 1.2 % | ||
| CVE-2023-29212 | >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability | CRITICAL 10.0 | 1.2 % | ||
| CVE-2023-29211 | >= 5.3-milestone-2, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability | CRITICAL 10.0 | 1.2 % | ||
| CVE-2023-29210 | >= 13.2-rc-1, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability | CRITICAL 10.0 | 1.2 % | ||
| CVE-2023-29209 | >= 10.9, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability | CRITICAL 10.0 | 1.1 % | ||
| CVE-2023-29208 | >= 1.2-milestone-1, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | Data leak through deleted documents | HIGH 7.5 | 0.9 % | ||
| CVE-2023-29207 | >= 1.9-milestone-2, < 13.10.10 ; >= 14.0-rc-1, < 14.4.6 ; >= 14.5, < 14.9 | Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro | CRITICAL 9.0 | 1.4 % | ||
| CVE-2023-29206 | >= 3.0-milestone-1, < 14.9-rc-1 | org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins | CRITICAL 9.1 | 0.9 % | ||
| CVE-2023-29205 | < 14.8-rc-1 | org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro | CRITICAL 10.0 | 0.6 % | ||
| CVE-2023-29204 | >= 6.0-rc-1, < 13.10.10 ; >= 14.0-rc-1, < 14.4.4 ; >= 14.5, < 14.8-rc-1 | URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore | MEDIUM 6.1 | 1.8 % | ||
| CVE-2023-29203 | >= 13.9-rc-1, < 13.10.8 ; >= 14.0-rc-1, < 14.4.3 ; >= 14.5, < 14.7-rc-1 | Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm | MEDIUM 5.3 | 0.7 % | ||
| CVE-2023-29202 | >= 1.8, <= 3.0.1 ; < 14.6-rc-1 | org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability | CRITICAL 9.1 | 1.4 % | ||
| CVE-2023-27480 | >= 1.1-milestone-3, < 13.10.11 ; >= 14.0.0, < 14.4.7 ; >= 14.5.0, < 14.10.0-rc-1 | Data leak through a XAR import XXE attack in xwiki-platform-xar-model | HIGH 7.7 | 0.7 % | ||
| CVE-2023-27479 | >= 6.3-milestone-2, < 13.10.11 ; >= 14.0.0, < 14.4.7 ; >= 14.5.0, < 14.10-rc-1 | Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui | CRITICAL 10.0 | 1.1 % | ||
| CVE-2023-26056 | >= 3.0-milestone-1, < 13.10.10 ; >= 14.0-rc-1, < 14.4.5 ; >= 14.5, < 14.8-rc-1 | XWiki Platform allows macro execution as any user without programming rights through the context macro | MEDIUM 5.4 | 0.6 % | ||
| CVE-2023-26470 | < 14.0-rc-1 | In XWiki Platform, saving a document with a large object number leads to persistent OOM errors | HIGH 7.5 | 0.9 % | ||
| CVE-2023-26471 | >= 11.6-rc-1, < 13.10.10 ; >= 14.0, < 14.4.6 ; >= 14.5, < 14.9 | XWiki Platform users may execute anything with superadmin right through comments and async macro | CRITICAL 10.0 | 0.9 % | ||
| CVE-2023-26472 | >= 6.2-milestone-1, < 13.10.10 ; >= 14.0, < 14.4.6 ; >= 14.5, < 14.9 | XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile | CRITICAL 10.0 | 1.1 % | ||
| CVE-2023-26473 | >= 1.3-rc-1, < 13.10.11 ; >= 14.0, < 14.4.7 ; >= 14.5, < 14.10 | XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-26474 | >= 13.10, < 13.10.11 ; >= 14.0, < 14.4.7 ; >= 14.5, < 14.10 | XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author | CRITICAL 10.0 | 0.8 % | ||
| CVE-2023-26475 | >= 2.3-milestone-1, < 13.10.11 ; >= 14.0-rc-1, < 14.4.7 ; >= 14.5, < 14.10 | XWiki Platform vulnerable to Remote Code Execution in Annotations | CRITICAL 10.0 | 64 % | ||
| CVE-2023-26476 | >= 3.2-m3, < 13.4.4 ; >= 13.5.0, < 13.10.9 ; >= 14.0.0, < 14.7-rc-1 | Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor | HIGH 7.5 | 2.2 % | ||
| CVE-2023-26477 | >= 6.2.4, < 13.10.10 ; >= 14.0, < 14.4.6 ; >= 14.5, < 14.9-rc-1 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability | CRITICAL 10.0 | 75 % | ||
| CVE-2023-26478 | >= 14.3-rc-1, < 14.4.6 ; >= 14.5, < 14.9-rc-1 | org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function | HIGH 8.1 | 0.7 % | ||
| CVE-2023-26479 | >= 6.0, < 13.10.10 ; >= 14.0, < 14.4.6 ; >= 14.5, < 14.9-rc-1 | org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-26480 | >= 12.10, < 13.10.10 ; >= 14.0, < 14.4.7 ; >= 14.5, < 14.9 | XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data | HIGH 8.9 | 0.7 % | ||
| CVE-2022-41935 | >= 12.10.11, < 13.10.8 ; >= 14.0.0, < 14.4.3 | Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui | MEDIUM 5.3 | 0.9 % | ||
| CVE-2022-41934 | < 13.10.8 ; >= 14.0.0, < 14.4.3 | Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui | CRITICAL 9.9 | 1.4 % | ||
| CVE-2022-41933 | >= 13.1RC1, < 13.10.8 ; >= 14.0.0, < 14.4.3 | Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default | MEDIUM 6.5 | 0.5 % | ||
| CVE-2022-41932 | < 13.10.8 ; >= 14.0.0, < 14.4.2 ; >= 14.5.0, < 14.6-rc-1 | Creation of new database tables through login form on PostgreSQL | HIGH 7.5 | 0.6 % | ||
| CVE-2022-41931 | >= 6.4-milestone-2, < 13.10.7 ; >= 14.0.0, < 14.4.2 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui | CRITICAL 9.9 | 1.3 % | ||
| CVE-2022-41930 | >= 12.4, < 13.10.7 ; >= 14.0.0, < 14.4.2 | org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users | HIGH 8.2 | 0.9 % | ||
| CVE-2022-41929 | >= 11.7RC1, < 13.10.7 ; >= 14.0.0, < 14.4.2 | Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore | MEDIUM 4.9 | 0.8 % | ||
| CVE-2022-41928 | >= 5.0-milestone-1, < 13.10.7 ; >= 14.0.0, < 14.4.2 | XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector… | CRITICAL 9.9 | 1.0 % | ||
| CVE-2022-41927 | >= 3.2-milestone-2, < 13.10.7 ; >= 14.0.0, < 14.4.1 | XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags | HIGH 7.4 | 0.3 % | ||
| CVE-2022-41937 | < 13.10.8 ; >= 14.0.0, < 14.4.3 ; >= 14.5.0, < 14.6-rc-1 | Missing Authorization in XWiki Platform | CRITICAL 9.6 | 0.8 % | ||
| CVE-2022-41936 | >= 8.1, < 13.10.8 ; >= 14.0.0, < 14.4.3 ; >= 14.5.0, < 14.6 | Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server | HIGH 7.5 | 0.8 % | ||
| CVE-2022-36100 | >= 1.7, < 13.10.6 ; >= 14.0, < 14.4 | XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection | CRITICAL 9.9 | 74 % | ||
| CVE-2022-36098 | >= 12.5-rc-1, < 13.10.6 ; >= 14.0, < 14.4 | XWiki Platform Mentions UI vulnerable to Cross-site Scripting | CRITICAL 9.0 | 72 % | ||
| CVE-2022-36099 | >= 5.3-milestone-2, < 13.10.6 ; >= 14.0, < 14.4 | XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability | CRITICAL 9.9 | 76 % | ||
| CVE-2022-36097 | >= 14.0-rc-1, < 14.4-rc-1 | XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form | HIGH 8.9 | 58 % | ||
| CVE-2022-36096 | >= 2.2-milestone-1, < 13.10.6 ; >= 14.0, < 14.3 | XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list | CRITICAL 9.0 | 60 % | ||
| CVE-2022-36095 | >= 2.0-milestone-1, < 13.10.5 ; >= 14.0, < 14.3 | XWiki Cross-Site Request Forgery (CSRF) for actions on tags | MEDIUM 4.3 | 0.4 % | ||
| CVE-2022-36094 | >= 1.0, < 13.10.6 ; >= 14.0, < 14.3-rc-1 | XWiki Platform Web Parent POM vulnerable to XSS in the attachment history | CRITICAL 9.0 | 65 % | ||
| CVE-2022-36093 | >= 8.0-rc-1, < 13.10.5 ; >= 14.0, < 14.3-rc-1 | XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard | HIGH 8.5 | 0.9 % | ||
| CVE-2022-36092 | < 13.10.4 ; >= 14.0, < 14.2 | XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action | HIGH 7.5 | 1.1 % |