Exposure of XWiki

Wikis
327
exposure score
34
sites use
1
exploited
122
critical

CVEs

250 results
CVE-2022-41929MEDIUMMissing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcoreEPSS 0.8%CVE-2023-26474CRITICALXWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorEPSS 0.8%CVE-2024-55662CRITICALXWiki allows remote code execution through the extension sheetEPSS 0.8%CVE-2023-32069CRITICALXWiki Platform privilege escalation (PR)/RCE from account through class sheetEPSS 0.8%CVE-2026-53966HIGHXWiki Platform: Privilege escalation from edit to script right through Live Data editingEPSS 0.8%CVE-2023-45137CRITICALXWiki Platform XSS with edit right in the create document form for existing pagesEPSS 0.8%CVE-2024-55663HIGHXWiki Platform has an SQL injection in getdocuments.vm with sort parameterEPSS 0.8%CVE-2025-49586HIGHXWiki allows remote code execution through preview of XClass changes in AWM editorEPSS 0.7%CVE-2023-27480HIGHData leak through a XAR import XXE attack in xwiki-platform-xar-modelEPSS 0.7%CVE-2023-35153CRITICALXWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parametersEPSS 0.7%CVE-2023-37910HIGHorg.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment MoveEPSS 0.7%CVE-2023-35151HIGHXWiki Platform may show email addresses in clear in REST resultsEPSS 0.7%CVE-2023-34464CRITICALXWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent templateEPSS 0.7%CVE-2023-48240CRITICALXWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgeryEPSS 0.7%CVE-2025-32430MEDIUMXWiki Platform contains Reflected XSS vulnerability in two templatesEPSS 0.7%CVE-2023-29203LOWUnauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm EPSS 0.7%CVE-2024-31988CRITICALXWiki Platform CSRF remote code execution through the realtime HTML Converter APIEPSS 0.7%CVE-2024-37899CRITICALDisabling a user account changes its author, allowing RCE from user account in XWikiEPSS 0.7%CVE-2025-54385HIGHXWiki Platform's searchDocuments API allows for SQL injectionEPSS 0.7%CVE-2022-23615MEDIUMPartial authorization bypass on document save in xwiki-platformEPSS 0.7%