Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

xwiki-platform — Vulnerabilities & Security Advisories 232

All 232 CVE vulnerabilities found in xwiki-platform, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) affecting the xwiki-platform, developed by XWiki SAS. It serves as a centralized resource for security professionals and developers seeking to understand the historical and current security posture of this specific open-source wiki software solution. The content on this page collects a wide variety of vulnerability types, including cross-site scripting, improper access control, and information disclosure flaws. The data covers incidents reported from the early 2010s through recent years, capturing the evolution of security issues associated with the platform over time. By navigating this aggregation, users can efficiently track vendor advisories and releases from XWiki to stay informed about critical patches and mitigation strategies. Additionally, visitors can deepen their understanding of specific weakness classes by examining how they manifest within the architectural context of xwiki-platform. The page also allows users to look up a product's vulnerability history, providing a chronological view of defects that have been identified and resolved. This historical perspective helps in assessing the long-term security reliability of the software and identifying recurring patterns in defect discovery. The resource is designed to facilitate thorough security analysis without requiring external database searches, consolidating disparate reports into a single, coherent view. It is important to note that this information is intended for educational and risk assessment purposes, aiding in the development of more secure coding practices and robust defensive configurations for systems relying on xwiki-platform.

Vendor: xwiki

CVE ID Title CVSS Severity Published
CVE-2024-38369 XWiki programming rights may be inherited by inclusion CWE-863 10.0 Critical 2024-06-24
CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki CWE-94 9.1 Critical 2024-06-20
CVE-2024-31997 XWiki Platform remote code execution from account through UIExtension parameters CWE-862 10.0 Critical 2024-04-10
CVE-2024-31988 XWiki Platform CSRF remote code execution through the realtime HTML Converter API CWE-352 9.7 Critical 2024-04-10
CVE-2024-31987 XWiki Platform remote code execution from account via custom skins support CWE-862 10.0 Critical 2024-04-10
CVE-2024-31986 XWiki Platform CSRF remote code execution through scheduler job's document reference CWE-352 9.1 Critical 2024-04-10
CVE-2024-31985 XWiki Platform CSRF in the job scheduler CWE-352 5.4 Medium 2024-04-10
CVE-2024-31984 XWiki Platform: Remote code execution through space title and Solr space facet CWE-95 10.0 Critical 2024-04-10
CVE-2024-31983 XWiki Platform: Remote code execution from edit in multilingual wikis via translations CWE-862 10.0 Critical 2024-04-10
CVE-2024-31982 XWiki Platform: Remote code execution as guest via DatabaseSearch CWE-95 10.0 Critical 2024-04-10
CVE-2024-31981 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass CWE-862 10.0 Critical 2024-04-10
CVE-2024-31465 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CWE-95 10.0 Critical 2024-04-10
CVE-2024-31464 XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted CWE-200 6.8 Medium 2024-04-10
CVE-2024-21648 XWiki has no right protection on rollback action CWE-274 8.0 High 2024-01-08
CVE-2024-21651 XWiki Denial of Service attack through attachments CWE-400 7.5 High 2024-01-08
CVE-2024-21650 XWiki Remote Code Execution vulnerability via user registration CWE-95 10.0 Critical 2024-01-08
CVE-2023-50732 Velocity execution without script right through tree macro CWE-863 8.3 High 2023-12-21
CVE-2023-50723 XWiki Platform remote code execution/programming rights with configuration section from any user account CWE-95 10.0 Critical 2023-12-15
CVE-2023-50722 XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass CWE-79 9.7 Critical 2023-12-15
CVE-2023-50721 XWiki Platform RCE from account through SearchAdmin CWE-95 10.0 Critical 2023-12-15
CVE-2023-50719 XWiki Platform Solr search discloses password hashes of all users CWE-359 7.5 High 2023-12-15
CVE-2023-50720 XWiki Platform Solr search discloses email addresses of users CWE-200 5.3 Medium 2023-12-15
CVE-2023-48241 XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service CWE-285 7.5 High 2023-11-20
CVE-2023-48240 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery CWE-201 9.1 Critical 2023-11-20
CVE-2023-46243 Code execution via the edit action in XWiki platform CWE-94 10.0 Critical 2023-11-07
CVE-2023-46242 Code injection in XWiki Platform CWE-94 9.7 Critical 2023-11-07
CVE-2023-46244 Privilege escalation in Xwiki platform CWE-863 9.1 Critical 2023-11-07
CVE-2023-46731 Remote code execution through the section parameter in Administration as guest in XWiki Platform CWE-94 10.0 Critical 2023-11-06
CVE-2023-46732 Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform CWE-79 9.7 Critical 2023-11-06
CVE-2023-45137 XWiki Platform XSS with edit right in the create document form for existing pages CWE-79 9.1 Critical 2023-10-25

All 232 known CVE vulnerabilities affecting xwiki-platform with full Chinese analysis, references, and POCs where available.