Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

xwiki-platform — Vulnerabilities & Security Advisories 232

All 232 CVE vulnerabilities found in xwiki-platform, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) affecting the xwiki-platform, developed by XWiki SAS. It serves as a centralized resource for security professionals and developers seeking to understand the historical and current security posture of this specific open-source wiki software solution. The content on this page collects a wide variety of vulnerability types, including cross-site scripting, improper access control, and information disclosure flaws. The data covers incidents reported from the early 2010s through recent years, capturing the evolution of security issues associated with the platform over time. By navigating this aggregation, users can efficiently track vendor advisories and releases from XWiki to stay informed about critical patches and mitigation strategies. Additionally, visitors can deepen their understanding of specific weakness classes by examining how they manifest within the architectural context of xwiki-platform. The page also allows users to look up a product's vulnerability history, providing a chronological view of defects that have been identified and resolved. This historical perspective helps in assessing the long-term security reliability of the software and identifying recurring patterns in defect discovery. The resource is designed to facilitate thorough security analysis without requiring external database searches, consolidating disparate reports into a single, coherent view. It is important to note that this information is intended for educational and risk assessment purposes, aiding in the development of more secure coding practices and robust defensive configurations for systems relying on xwiki-platform.

Vendor: xwiki

CVE ID Title CVSS Severity Published
CVE-2023-45136 XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled CWE-79 9.7 Critical 2023-10-25
CVE-2023-45135 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title CWE-116 9.1 Critical 2023-10-25
CVE-2023-45134 XWiki Platform XSS vulnerability from account in the create page form via template provider CWE-79 9.1 Critical 2023-10-25
CVE-2023-37913 org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter CWE-23 10.0 Critical 2023-10-25
CVE-2023-37911 org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents CWE-668 6.5 Medium 2023-10-25
CVE-2023-37910 org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move CWE-862 8.1 High 2023-10-25
CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet CWE-95 10.0 Critical 2023-10-25
CVE-2023-41046 Velocity execution without script rights in Xwiki platform CWE-862 6.3 Medium 2023-09-01
CVE-2023-40573 XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution CWE-284 9.1 Critical 2023-08-24
CVE-2023-40572 XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action CWE-352 9.1 Critical 2023-08-24
CVE-2023-40177 XWiki Platform privilege escalation (PR) from account through AWM content fields CWE-95 9.9 Critical 2023-08-23
CVE-2023-40176 SXSS in the user profile via the timezone displayer CWE-79 9.1 Critical 2023-08-23
CVE-2023-37914 Privilege escalation (PR)/RCE from account through Invitation subject/message CWE-94 9.9 Critical 2023-08-17
CVE-2023-38509 XWiki Platform's obfuscated email addresses should not be sorted CWE-402 4.3 Medium 2023-07-27
CVE-2023-37462 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui CWE-74 10.0 Critical 2023-07-14
CVE-2023-37277 XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API CWE-352 9.7 Critical 2023-07-10
CVE-2023-36477 Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform CWE-79 9.1 Critical 2023-06-30
CVE-2023-36468 Upgrading doesn't prevent exploiting vulnerable XWiki documents CWE-459 10.0 Critical 2023-06-29
CVE-2023-36469 Code injection through NotificationRSSService in XWiki Platform CWE-74 10.0 Critical 2023-06-29
CVE-2023-36470 Code injection in icon themes of XWiki Platform CWE-74 10.0 Critical 2023-06-29
CVE-2023-35162 XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template CWE-79 9.7 Critical 2023-06-23
CVE-2023-35161 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page CWE-87 9.7 Critical 2023-06-23
CVE-2023-35160 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template CWE-87 9.7 Critical 2023-06-23
CVE-2023-35159 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template CWE-87 9.7 Critical 2023-06-23
CVE-2023-35158 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template CWE-87 9.7 Critical 2023-06-23
CVE-2023-35157 XWiki Platform vulnerable to reflected cross-site scripting via delattachment action CWE-80 8.5 High 2023-06-23
CVE-2023-35156 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template CWE-87 9.7 Critical 2023-06-23
CVE-2023-35155 XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email CWE-79 8.8 High 2023-06-23
CVE-2023-35153 XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters CWE-79 9.1 Critical 2023-06-23
CVE-2023-35152 XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults CWE-95 10.0 Critical 2023-06-23

All 232 known CVE vulnerabilities affecting xwiki-platform with full Chinese analysis, references, and POCs where available.