Filter
Software
Xwiki Pdf Viewer Macromacro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author
7.5
First published (updated )
Xwiki Pdf Viewer MacroThe PDF viewer macro allows accessing any attachment without access right checks
7.5
First published (updated )
Xwiki Pdf Viewer Macromacro-pdfviewer has a XSS through the width parameter
9.1
First published (updated )
maven/org.xwiki.platform:xwiki-platform-rest-serverXWiki Platform document history including authors of any page exposed to unauthorized actors
5.3
First published (updated )
maven/org.xwiki.platform:xwiki-platform-oldcoreXWiki Platform allows XSS through XClass name in string properties
9.1
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
maven/org.xwiki.platform:xwiki-platform-web-templatesIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
9.1
First published (updated )
Xwiki Pro MacrosPro Macros Remote Code Execution via Viewpdf and similar macros
10
First published (updated )
maven/org.xwiki.platform:xwiki-platform-web-templatesXWiki Platform XSS through conflict resolution
9.1
First published (updated )
maven/org.xwiki.platform:xwiki-platform-search-uiXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
10
First published (updated )
Xwiki XwikiXWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
6.4
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki Platform vulnerable to document deletion and overwrite from edit
4.3
First published (updated )
maven/org.xwiki.platform:xwiki-platform-rendering-macro-includeXWiki programming rights may be inherited by inclusion
10
First published (updated )
maven/org.xwiki.platform:xwiki-platform-distribution-warXWiki Denial of Service attack through attachments
7.5
EPSS
0.05%
First published (updated )
Xwiki XwikiXWiki has no right protection on rollback action
8.8
EPSS
0.06%
First published (updated )
maven/org.xwiki.platform:xwiki-platform-administration-uiXWiki Remote Code Execution vulnerability via user registration
10
EPSS
0.58%
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
maven/org.xwiki.platform:xwiki-platform-index-tree-macroVelocity execution without script right through tree macro
8.3
First published (updated )
Xwiki XwikiXWiki Platform remote code execution/programming rights with configuration section from any user account
10
First published (updated )
Xwiki XwikiXWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
9.6
First published (updated )
Xwiki XwikiXWiki Platform RCE from account through SearchAdmin
10
First published (updated )
Xwiki XwikiXWiki Platform Solr search discloses password hashes of all users
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki Platform Solr search discloses email addresses of users
5.3
First published (updated )
maven/org.xwiki.contrib.changerequest:application-changerequest-defaultData leak of password hash through xwiki change request
7.7
First published (updated )
maven/org.xwiki.contrib:xwiki-application-admintoolsXWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries
8.8
First published (updated )
maven/org.xwiki.contrib:xwiki-application-admintoolsXWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks
9.6
First published (updated )
Xwiki XwikiXWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
First published (updated )
CVE-2023-46743The same file cannot be opened with different rights
7.4
First published (updated )
maven/org.xwiki.platform:xwiki-platform-oldcoreCode execution via the edit action in XWiki platform
10
First published (updated )
maven/org.xwiki.platform:xwiki-platform-oldcoreCode injection in XWiki Platform
9.6
First published (updated )
Xwiki XwikiPrivilege escalation in Xwiki platform
9.1
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
maven/org.xwiki.platform:xwiki-platform-administration-uiRemote code execution through the section parameter in Administration as guest in XWiki Platform
10
First published (updated )
maven/org.xwiki.platform:xwiki-platform-flamingo-skin-resourcesReflected Cross-site scripting through revision parameter in content menu in XWiki Platform
9.6
First published (updated )
Xwiki XwikiXWiki Platform XSS with edit right in the create document form for existing pages
First published (updated )
Xwiki XwikiXWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
9.6
First published (updated )
Xwiki XwikiXWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki Platform XSS vulnerability from account in the create page form via template provider
First published (updated )
Xwiki Xwikiorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
10
First published (updated )
Xwiki Xwiki-renderingXWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
10
First published (updated )
Xwiki Xwikiorg.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents
6.5
First published (updated )
Xwiki Xwikiorg.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move
8.1
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
maven/org.xwiki.platform:xwiki-platform-menu-uiPrivilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
10
First published (updated )
Xwiki Xwiki-renderingorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
9.6
First published (updated )
maven/com.xwiki.identity-oauth:identity-oauth-uiRemote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App
10
First published (updated )
maven/org.xwiki.contrib.changerequest:application-changerequest-uiChange Request Application vulnerable to XSS and remote code execution through change request title
10
First published (updated )
Xwiki XwikiVelocity execution without script rights in Xwiki platform
6.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Xwiki XwikiXWiki Platform's Groovy jobs check the wrong author, allowing remote code execution
First published (updated )
Xwiki XwikiXWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
9.1
First published (updated )
Xwiki XwikiXWiki Platform privilege escalation (PR) from account through AWM content fields
9.9
First published (updated )
Xwiki XwikiSXSS in the user profile via the timezone displayer
9.1
First published (updated )
Xwiki XwikiPrivilege escalation (PR)/RCE from account through Invitation subject/message
9.9
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.