Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2025-24893 | Remote code execution as guest via SolrSearchMacros request in xwiki | * | 9.8 | KEV | 100.0% | 2025-02-21 |
| CVE-2026-53966 | XWiki Platform: Privilege escalation from edit to script right through Live Data editing | * | 7.1 | — | 2026-09-15 | |
| CVE-2026-34151 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ | * | 8.2 | — | 2026-09-15 | |
| CVE-2026-48048 | XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests | * | 7.5 | — | 2026-08-11 | |
| CVE-2026-48047 | XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin | * | 5.9 | — | 2026-08-08 | |
| CVE-2026-33137 | XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} | * | 9.3 | — | 2026-05-21 | |
| CVE-2026-40105 | XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality | * | 6.5 | — | 2026-04-15 | |
| CVE-2026-40104 | XWiki's REST APIs can list all pages/spaces, leading to unavailability | * | 6.9 | — | 2026-04-15 | |
| CVE-2026-33229 | XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API | * | 8.6 | — | 2026-04-08 | |
| CVE-2026-26000 | XWiki Platform affected by click-jacking through CSS injection in comments | * | 5.3 | — | 2026-02-13 | |
| CVE-2026-24128 | XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages | * | 6.5 | — | 2026-01-24 | |
| CVE-2025-66474 | XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection | * | 8.7 | — | 2025-12-11 | |
| CVE-2025-66473 | XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis | * | 8.7 | — | 2025-12-11 | |
| CVE-2025-66472 | XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication | * | 6.5 | — | 2025-12-11 | |
| CVE-2025-55749 | The XWiki Jetty package (XJetty) allows accessing any application file through URL | * | 8.7 | — | 2025-12-02 | |
| CVE-2025-52472 | XWiki Platform vulnerable to HQL injection via wiki and space search REST API | * | 9.3 | — | 2025-10-06 | |
| CVE-2025-55748 | XWiki Platform's configuration files can be accessed through jsx and sx endpoints | * | 9.3 | — | 2025-09-04 | |
| CVE-2025-55747 | XWiki Platform's configuration files can be accessed through the webjars API | * | 9.3 | — | 2025-09-04 | |
| CVE-2025-58049 | XWiki PDF export jobs store sensitive cookies unencrypted in job statuses | * | 5.8 | — | 2025-08-29 | |
| CVE-2025-54125 | XWiki Platform: Password and email exposure in xml.vm fields | * | 8.7 | — | 2025-08-06 | |
| CVE-2025-54124 | XWiki Platform: Any user with editing rights can access password properties through Database List Properties | * | 7.1 | — | 2025-08-06 | |
| CVE-2025-32430 | XWiki Platform contains Reflected XSS vulnerability in two templates | * | 6.5 | — | 2025-08-06 | |
| CVE-2025-54385 | XWiki Platform's searchDocuments API allows for SQL injection | * | 8.6 | — | 2025-07-26 | |
| CVE-2025-32429 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter | * | 9.3 | — | 2025-07-25 | |
| CVE-2025-49587 | XWiki does not require right warnings for notification displayer objects | * | 6.4 | — | 2025-06-14 | |
| CVE-2025-49586 | XWiki allows remote code execution through preview of XClass changes in AWM editor | * | 8.7 | — | 2025-06-14 | |
| CVE-2025-49585 | XWiki does not require right warnings for XClass definitions | * | 8.6 | — | 2025-06-14 | |
| CVE-2025-49584 | XWiki makes title of inaccessible pages available through the class property values REST API | * | 8.7 | — | 2025-06-14 | |
| CVE-2025-49583 | XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right | * | 5.1 | — | 2025-06-14 | |
| CVE-2025-49582 | XWiki's required right warnings for macros are incomplete | * | 8.6 | — | 2025-06-14 | |
| CVE-2025-49581 | XWiki allows remote code execution through default value of wiki macro wiki-type parameters | * | 8.7 | — | 2025-06-14 | |
| CVE-2025-49580 | XWiki allows privilege escalation through link refactoring | * | 8.5 | — | 2025-06-14 | |
| CVE-2024-56158 | XWiki allows SQL injection in query endpoint of REST API with Oracle | * | 9.3 | — | 2025-06-12 | |
| CVE-2025-48063 | XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights wit... | * | 4.8 | — | 2025-05-22 | |
| CVE-2025-46554 | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API | * | 5.3 | — | 2025-05-01 | |
| CVE-2025-46557 | Any user with view access to the XWiki space can change the authenticator | * | 8.4 | — | 2025-05-01 | |
| CVE-2025-32973 | org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass progra... | * | 9.1 | — | 2025-04-30 | |
| CVE-2025-32974 | org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider Te... | * | 9.1 | — | 2025-04-30 | |
| CVE-2025-32972 | The lesscss script service allows cache clearing without programming right | * | 2.7 | — | 2025-04-30 | |
| CVE-2025-32971 | XWiki Solr script service doesn't take dropped programming right into account | * | 3.8 | — | 2025-04-30 | |
| CVE-2025-32970 | org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability | * | 6.1 | — | 2025-04-30 | |
| CVE-2025-32969 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API | * | 9.3 | — | 2025-04-24 | |
| CVE-2025-32968 | org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the scrip... | * | 8.6 | — | 2025-04-24 | |
| CVE-2025-32783 | XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different... | * | 4.7 | — | 2025-04-17 | |
| CVE-2025-29926 | The WikiManager REST API allows any user to create wikis | * | 7.9 | — | 2025-03-20 | |
| CVE-2025-29925 | XWiki allows unregistered users to access private pages information through REST endpoint | * | 8.7 | — | 2025-03-20 | |
| CVE-2025-29924 | XWiki uses the wrong wiki reference in AuthorizationManager | * | 8.7 | — | 2025-03-20 | |
| CVE-2025-23025 | Privilege escalation (PR) through realtime WYSIWYG editing in XWiki | * | 9.1 | — | 2025-01-15 | |
| CVE-2024-55879 | XWiki allows RCE from script right in configurable sections | * | 9.1 | — | 2024-12-13 | |
| CVE-2024-55877 | XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList | * | 10.0 | — | 2024-12-13 | |
| CVE-2024-55876 | XWiki's scheduler in subwiki allows scheduling operations for any main wiki user | * | 5.4 | — | 2024-12-13 | |
| CVE-2024-55663 | XWiki Platform has an SQL injection in getdocuments.vm with sort parameter | * | 8.6 | — | 2024-12-13 | |
| CVE-2024-55662 | XWiki allows remote code execution through the extension sheet | * | 10.0 | — | 2024-12-13 | |
| CVE-2024-46978 | Missing checks for notification filter preferences editions in XWiki Platform | * | 6.5 | — | 2024-09-19 | |
| CVE-2024-46979 | Data leak of notification filters of users in XWiki Platform | * | 5.3 | — | 2024-09-19 | |
| CVE-2024-45591 | XWiki Platform document history including authors of any page exposed to unauthorized actors | * | 5.3 | — | 2024-09-11 | |
| CVE-2024-43400 | XWiki Platform allows XSS through XClass name in string properties | * | 9.1 | — | 2024-08-20 | |
| CVE-2024-43401 | In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them | * | 9.1 | — | 2024-08-20 | |
| CVE-2024-41947 | XWiki Platform XSS through conflict resolution | * | 9.1 | — | 2024-08-01 | |
| CVE-2024-37901 | XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet | * | 10.0 | — | 2024-08-01 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).