Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

xwiki-platform — Vulnerabilities & Security Advisories 232

All 232 CVE vulnerabilities found in xwiki-platform, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) affecting the xwiki-platform, developed by XWiki SAS. It serves as a centralized resource for security professionals and developers seeking to understand the historical and current security posture of this specific open-source wiki software solution. The content on this page collects a wide variety of vulnerability types, including cross-site scripting, improper access control, and information disclosure flaws. The data covers incidents reported from the early 2010s through recent years, capturing the evolution of security issues associated with the platform over time. By navigating this aggregation, users can efficiently track vendor advisories and releases from XWiki to stay informed about critical patches and mitigation strategies. Additionally, visitors can deepen their understanding of specific weakness classes by examining how they manifest within the architectural context of xwiki-platform. The page also allows users to look up a product's vulnerability history, providing a chronological view of defects that have been identified and resolved. This historical perspective helps in assessing the long-term security reliability of the software and identifying recurring patterns in defect discovery. The resource is designed to facilitate thorough security analysis without requiring external database searches, consolidating disparate reports into a single, coherent view. It is important to note that this information is intended for educational and risk assessment purposes, aiding in the development of more secure coding practices and robust defensive configurations for systems relying on xwiki-platform.

Vendor: xwiki

CVE ID Title CVSS Severity Published
CVE-2026-53966 XWiki Platform: Privilege escalation from edit to script right through Live Data editing CWE-862 7.1 High 2026-09-15
CVE-2026-34151 XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ CWE-24 8.2 High 2026-09-14
CVE-2026-48048 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests CWE-359 7.5 High 2026-08-10
CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin CWE-24 5.9 Medium 2026-08-07
CVE-2026-33137 XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} CWE-862 - - 2026-05-20
CVE-2026-40105 XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality CWE-80 8.8 - 2026-04-15
CVE-2026-33229 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API CWE-862 9.9AI Critical AI 2026-04-08
CVE-2026-26000 XWiki Platform affected by click-jacking through CSS injection in comments CWE-1021 4.1AI Medium AI 2026-02-12
CVE-2026-24128 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages CWE-79 9.6 - 2026-01-23
CVE-2025-66473 XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis CWE-770 7.5AI High AI 2025-12-10
CVE-2025-66472 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication CWE-79 6.1AI Medium AI 2025-12-10
CVE-2025-55749 The XWiki Jetty package (XJetty) allows accessing any application file through URL CWE-284 7.5AI High AI 2025-12-01
CVE-2025-52472 XWiki Platform vulnerable to HQL injection via wiki and space search REST API CWE-89 7.1AI High AI 2025-10-06
CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints CWE-23 7.5AI High AI 2025-09-03
CVE-2025-55747 XWiki Platform's configuration files can be accessed through the webjars API CWE-23 7.5AI High AI 2025-09-03
CVE-2025-58049 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses CWE-212 5.8 Medium 2025-08-28
CVE-2025-54125 XWiki Platform: Password and email exposure in xml.vm fields CWE-359 8.1AI High AI 2025-08-05
CVE-2025-54124 XWiki Platform: Any user with editing rights can access password properties through Database List Properties CWE-359 6.5AI Medium AI 2025-08-05
CVE-2025-32430 XWiki Platform contains Reflected XSS vulnerability in two templates CWE-79 6.1AI Medium AI 2025-08-05
CVE-2025-54385 XWiki Platform's searchDocuments API allows for SQL injection CWE-20 8.8 - 2025-07-26
CVE-2025-32429 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CWE-89 9.8 - 2025-07-24
CVE-2025-49587 XWiki does not require right warnings for notification displayer objects CWE-357 5.4AI Medium AI 2025-06-13
CVE-2025-49586 XWiki allows remote code execution through preview of XClass changes in AWM editor CWE-863 8.8AI High AI 2025-06-13
CVE-2025-49585 XWiki does not require right warnings for XClass definitions CWE-357 6.3AI Medium AI 2025-06-13
CVE-2025-49584 XWiki makes title of inaccessible pages available through the class property values REST API CWE-201 5.3AI Medium AI 2025-06-13
CVE-2025-49583 XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right CWE-270 4.6AI Medium AI 2025-06-13
CVE-2025-49582 XWiki's required right warnings for macros are incomplete CWE-357 5.4AI Medium AI 2025-06-13
CVE-2025-49581 XWiki allows remote code execution through default value of wiki macro wiki-type parameters CWE-94 8.8AI High AI 2025-06-13
CVE-2025-49580 XWiki allows privilege escalation through link refactoring CWE-266 9.3AI Critical AI 2025-06-13
CVE-2024-56158 XWiki allows SQL injection in query endpoint of REST API with Oracle CWE-89 9.8AI Critical AI 2025-06-12

All 232 known CVE vulnerabilities affecting xwiki-platform with full Chinese analysis, references, and POCs where available.