Filters
Software
maven/org.xwiki.platform:xwiki-platform-rest-serverXWiki Platform document history including authors of any page exposed to unauthorized actors
5.3
First published (updated )
maven/org.xwiki.platform:xwiki-platform-oldcoreXWiki Platform allows XSS through XClass name in string properties
9.1
First published (updated )
maven/org.xwiki.platform:xwiki-platform-web-templatesIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
9.1
First published (updated )
Xwiki Pro MacrosPro Macros Remote Code Execution via Viewpdf and similar macros
10
First published (updated )
maven/org.xwiki.platform:xwiki-platform-web-templatesXWiki Platform XSS through conflict resolution
9.1
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
maven/org.xwiki.platform:xwiki-platform-search-uiXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
10
First published (updated )
Xwiki XwikiXWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
6.4
First published (updated )
Xwiki XwikiXWiki Platform vulnerable to document deletion and overwrite from edit
4.3
First published (updated )
maven/org.xwiki.platform:xwiki-platform-rendering-macro-includeXWiki programming rights may be inherited by inclusion
10
First published (updated )
maven/org.xwiki.platform:xwiki-platform-distribution-warXWiki Denial of Service attack through attachments
7.5
EPSS
0.05%
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki has no right protection on rollback action
8.8
EPSS
0.06%
First published (updated )
maven/org.xwiki.platform:xwiki-platform-administration-uiXWiki Remote Code Execution vulnerability via user registration
10
EPSS
0.58%
First published (updated )
maven/org.xwiki.platform:xwiki-platform-index-tree-macroVelocity execution without script right through tree macro
8.3
First published (updated )
Xwiki XwikiXWiki Platform remote code execution/programming rights with configuration section from any user account
10
First published (updated )
Xwiki XwikiXWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
9.6
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki Platform RCE from account through SearchAdmin
10
First published (updated )
Xwiki XwikiXWiki Platform Solr search discloses password hashes of all users
7.5
First published (updated )
Xwiki XwikiXWiki Platform Solr search discloses email addresses of users
5.3
First published (updated )
maven/org.xwiki.contrib.changerequest:application-changerequest-defaultData leak of password hash through xwiki change request
7.7
First published (updated )
maven/org.xwiki.contrib:xwiki-application-admintoolsXWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries
8.8
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
maven/org.xwiki.contrib:xwiki-application-admintoolsXWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks
9.6
First published (updated )
Xwiki XwikiXWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service
7.5
First published (updated )
Xwiki XwikiXWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
First published (updated )
Xwiki Application-collaboraThe same file cannot be opened with different rights
7.4
First published (updated )
Xwiki XwikiCode execution via the edit action in XWiki platform
10
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiPrivilege escalation in Xwiki platform
9.1
First published (updated )
maven/org.xwiki.platform:xwiki-platform-administration-uiRemote code execution through the section parameter in Administration as guest in XWiki Platform
10
First published (updated )
maven/org.xwiki.platform:xwiki-platform-flamingo-skin-resourcesReflected Cross-site scripting through revision parameter in content menu in XWiki Platform
9.6
First published (updated )
Xwiki XwikiXWiki Platform XSS with edit right in the create document form for existing pages
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
9.6
First published (updated )
Xwiki XwikiXWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
First published (updated )
Xwiki XwikiXWiki Platform XSS vulnerability from account in the create page form via template provider
First published (updated )
Xwiki Xwikiorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
10
First published (updated )
Xwiki Xwiki-renderingXWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
10
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki Xwikiorg.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents
6.5
First published (updated )
Xwiki Xwikiorg.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move
8.1
First published (updated )
maven/org.xwiki.platform:xwiki-platform-menu-uiPrivilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
10
First published (updated )
Xwiki Xwiki-renderingorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
9.6
First published (updated )
maven/com.xwiki.identity-oauth:identity-oauth-uiRemote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App
10
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
maven/org.xwiki.contrib.changerequest:application-changerequest-uiChange Request Application vulnerable to XSS and remote code execution through change request title
10
First published (updated )
Xwiki XwikiVelocity execution without script rights in Xwiki platform
6.3
First published (updated )
Xwiki XwikiXWiki Platform's Groovy jobs check the wrong author, allowing remote code execution
First published (updated )
Xwiki XwikiXWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
9.1
First published (updated )
Xwiki XwikiXWiki Platform privilege escalation (PR) from account through AWM content fields
9.9
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiSXSS in the user profile via the timezone displayer
9.1
First published (updated )
Xwiki XwikiPrivilege escalation (PR)/RCE from account through Invitation subject/message
9.9
First published (updated )
maven/org.xwiki.platform:xwiki-platform-livetable-uiXWiki Platform's obfuscated email addresses should not be sorted
4.3
First published (updated )
Xwiki XwikiImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui
10
First published (updated )
Xwiki XwikiXWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
9.6
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.