Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

xwiki-platform — Vulnerabilities & Security Advisories 232

All 232 CVE vulnerabilities found in xwiki-platform, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) affecting the xwiki-platform, developed by XWiki SAS. It serves as a centralized resource for security professionals and developers seeking to understand the historical and current security posture of this specific open-source wiki software solution. The content on this page collects a wide variety of vulnerability types, including cross-site scripting, improper access control, and information disclosure flaws. The data covers incidents reported from the early 2010s through recent years, capturing the evolution of security issues associated with the platform over time. By navigating this aggregation, users can efficiently track vendor advisories and releases from XWiki to stay informed about critical patches and mitigation strategies. Additionally, visitors can deepen their understanding of specific weakness classes by examining how they manifest within the architectural context of xwiki-platform. The page also allows users to look up a product's vulnerability history, providing a chronological view of defects that have been identified and resolved. This historical perspective helps in assessing the long-term security reliability of the software and identifying recurring patterns in defect discovery. The resource is designed to facilitate thorough security analysis without requiring external database searches, consolidating disparate reports into a single, coherent view. It is important to note that this information is intended for educational and risk assessment purposes, aiding in the development of more secure coding practices and robust defensive configurations for systems relying on xwiki-platform.

Vendor: xwiki

CVE ID Title CVSS Severity Published
CVE-2023-35151 XWiki Platform may show email addresses in clear in REST results CWE-359 7.5 High 2023-06-23
CVE-2023-35150 XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application CWE-95 9.9 Critical 2023-06-23
CVE-2023-34467 XWiki Platform may retrieve email addresses of all users CWE-402 7.5 High 2023-06-23
CVE-2023-34466 XWiki Platform's tags on non-viewable pages can be revealed to users CWE-200 4.3 Medium 2023-06-23
CVE-2023-34465 XWiki Platform's Mail.MailConfig can be edited by any user with edit rights CWE-269 10.0 Critical 2023-06-23
CVE-2023-34464 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template CWE-79 9.1 Critical 2023-06-23
CVE-2023-35166 Privilege escalation (PR) from account through TipsPanel CWE-863 10.0 Critical 2023-06-20
CVE-2023-32068 URL Redirection to Untrusted Site in XWiki CWE-601 4.7 Medium 2023-05-15
CVE-2023-32071 XWiki Platform vulnerable to RXSS via editor parameter - importinline template CWE-116 9.1 Critical 2023-05-09
CVE-2023-32069 XWiki Platform privilege escalation (PR)/RCE from account through class sheet CWE-863 10.0 Critical 2023-05-09
CVE-2023-29517 Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer CWE-200 7.5 High 2023-04-18
CVE-2023-29516 Code injection from view right on XWiki.AttachmentSelector in xwiki-platform CWE-74 9.9 Critical 2023-04-18
CVE-2023-29515 Cross-site scripting (XSS) in xwiki-platform CWE-79 7.7 High 2023-04-18
CVE-2023-29514 Code injection in template provider administration in xwiki-platform CWE-74 10.0 Critical 2023-04-18
CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform CWE-284 5.0 Medium 2023-04-18
CVE-2023-29512 Code injection in xwiki-platform-web-templates CWE-74 9.9 Critical 2023-04-18
CVE-2023-29510 Code injection via unescaped translations in xwiki-platform CWE-74 10.0 Critical 2023-04-18
CVE-2023-29522 Code injection from view right on XWiki.ClassSheet in xwiki-platform CWE-74 9.9 Critical 2023-04-18
CVE-2023-29521 Code injection from account/view through VFS Tree macro in xwiki-platform CWE-74 8.4 High 2023-04-18
CVE-2023-29520 Page render failure due to broken translations in xwiki-platform CWE-248 4.3 Medium 2023-04-18
CVE-2023-29519 Code injection in org.xwiki.platform:xwiki-platform-attachment-ui CWE-74 9.1 Critical 2023-04-18
CVE-2023-29518 Code injection from view right using Invitation.InvitationCommon in xwiki-platform CWE-74 9.9 Critical 2023-04-18
CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform CWE-74 10.0 Critical 2023-04-18
CVE-2023-29524 Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform CWE-74 10.0 Critical 2023-04-18
CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform CWE-74 10.0 Critical 2023-04-18
CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode CWE-74 10.0 Critical 2023-04-18
CVE-2023-29527 Code injection from account through AWM view sheet in xwiki platform CWE-74 10.0 Critical 2023-04-18
CVE-2023-29213 org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability CWE-74 9.1 Critical 2023-04-17
CVE-2023-29511 xwiki-platform-administration-ui vulnerable to privilege escalation CWE-95 9.9 Critical 2023-04-16
CVE-2023-30537 org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation CWE-95 9.9 Critical 2023-04-16

All 232 known CVE vulnerabilities affecting xwiki-platform with full Chinese analysis, references, and POCs where available.