Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

xwiki-platform — Vulnerabilities & Security Advisories 232

All 232 CVE vulnerabilities found in xwiki-platform, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) affecting the xwiki-platform, developed by XWiki SAS. It serves as a centralized resource for security professionals and developers seeking to understand the historical and current security posture of this specific open-source wiki software solution. The content on this page collects a wide variety of vulnerability types, including cross-site scripting, improper access control, and information disclosure flaws. The data covers incidents reported from the early 2010s through recent years, capturing the evolution of security issues associated with the platform over time. By navigating this aggregation, users can efficiently track vendor advisories and releases from XWiki to stay informed about critical patches and mitigation strategies. Additionally, visitors can deepen their understanding of specific weakness classes by examining how they manifest within the architectural context of xwiki-platform. The page also allows users to look up a product's vulnerability history, providing a chronological view of defects that have been identified and resolved. This historical perspective helps in assessing the long-term security reliability of the software and identifying recurring patterns in defect discovery. The resource is designed to facilitate thorough security analysis without requiring external database searches, consolidating disparate reports into a single, coherent view. It is important to note that this information is intended for educational and risk assessment purposes, aiding in the development of more secure coding practices and robust defensive configurations for systems relying on xwiki-platform.

Vendor: xwiki

CVE ID Title CVSS Severity Published
CVE-2025-48063 XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right CWE-285 7.1AI High AI 2025-05-21
CVE-2025-46554 XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API CWE-862 5.3 Medium 2025-04-30
CVE-2025-46557 Any user with view access to the XWiki space can change the authenticator CWE-862 8.1AI High AI 2025-04-30
CVE-2025-32973 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right CWE-862 9.1 Critical 2025-04-30
CVE-2025-32974 org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type CWE-116 9.1 Critical 2025-04-30
CVE-2025-32972 The lesscss script service allows cache clearing without programming right CWE-285 2.7 Low 2025-04-30
CVE-2025-32971 XWiki Solr script service doesn't take dropped programming right into account CWE-863 3.8 Low 2025-04-30
CVE-2025-32970 org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability CWE-601 6.1 Medium 2025-04-30
CVE-2025-32969 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CWE-89 9.8 - 2025-04-23
CVE-2025-32968 org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API CWE-89 8.8 - 2025-04-23
CVE-2025-32783 XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki CWE-668 4.7 Medium 2025-04-16
CVE-2025-29926 The WikiManager REST API allows any user to create wikis CWE-285 8.8 - 2025-03-19
CVE-2025-29925 XWiki allows unregistered users to access private pages information through REST endpoint CWE-402 5.3 - 2025-03-19
CVE-2025-29924 XWiki uses the wrong wiki reference in AuthorizationManager CWE-269 6.5 - 2025-03-19
CVE-2025-24893 Remote code execution as guest via SolrSearchMacros request in xwiki CWE-95 9.8 Critical 2025-02-20
CVE-2025-23025 Privilege escalation (PR) through realtime WYSIWYG editing in XWiki CWE-862 9.1 Critical 2025-01-14
CVE-2024-55879 XWiki allows RCE from script right in configurable sections CWE-862 9.1 Critical 2024-12-12
CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList CWE-96 10.0 Critical 2024-12-12
CVE-2024-55876 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user CWE-862 7.1 - 2024-12-12
CVE-2024-55663 XWiki Platform has an SQL injection in getdocuments.vm with sort parameter CWE-116 8.8 - 2024-12-12
CVE-2024-55662 XWiki allows remote code execution through the extension sheet CWE-96 10.0 Critical 2024-12-12
CVE-2024-46978 Missing checks for notification filter preferences editions in XWiki Platform CWE-648 6.5 Medium 2024-09-18
CVE-2024-46979 Data leak of notification filters of users in XWiki Platform CWE-200 5.3 Medium 2024-09-18
CVE-2024-45591 XWiki Platform document history including authors of any page exposed to unauthorized actors CWE-862 5.3 Medium 2024-09-10
CVE-2024-43400 XWiki Platform allows XSS through XClass name in string properties CWE-96 9.1 Critical 2024-08-19
CVE-2024-43401 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them CWE-269 9.1 Critical 2024-08-19
CVE-2024-41947 XWiki Platform XSS through conflict resolution CWE-80 9.1 Critical 2024-07-31
CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet CWE-95 10.0 Critical 2024-07-31
CVE-2024-37900 XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader CWE-96 6.4 Medium 2024-07-31
CVE-2024-37898 XWiki Platform vulnerable to document deletion and overwrite from edit CWE-862 4.3 Medium 2024-07-31

All 232 known CVE vulnerabilities affecting xwiki-platform with full Chinese analysis, references, and POCs where available.