Exposição de XWiki

Wikis
328
score de exposição
34
sites usam
1
em exploração
122
críticos
Análise Vexday

Com 245 CVEs catalogadas, o XWiki apresenta um volume expressivo de vulnerabilidades, sendo 121 delas de severidade crítica — número que por si só justifica atenção redobrada em ambientes que utilizam a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que, em wikis colaborativos com renderização de conteúdo rico, tende a ter superfície de ataque ampla e impacto relevante sobre usuários autenticados. A CVE mais perigosa atualmente ativa é CVE-2025-24893, com score EPSS de 0,999 — valor que indica probabilidade extremamente alta de exploração ativa —, exigindo priorização imediata de remediação. A taxa de exploração confirmada no CISA KEV está em linha com a média geral do catálogo, mas o EPSS elevado dessa CVE sugere que a exposição real pode ser significativamente maior do que o número de entradas KEV indica.

CVEs

250 resultados
CVE-2024-31981CRITICALXWiki Platform: Privilege escalation (PR) from user registration through PDFClassEPSS 1.4%CVE-2023-29202CRITICALorg.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityEPSS 1.4%CVE-2023-29207HIGHImproper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroEPSS 1.4%CVE-2022-41934CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-uiEPSS 1.4%CVE-2023-37913CRITICALorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converterEPSS 1.4%CVE-2021-21380HIGHRating Script Service expose XWiki to SQL injectionEPSS 1.3%CVE-2020-15171MEDIUMUsers with SCRIPT rights can execute arbitrary code in XWikiEPSS 1.3%CVE-2022-29251HIGHCross-site Scripting in the Flamingo theme managerEPSS 1.3%CVE-2022-41931CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-uiEPSS 1.3%CVE-2023-29528CRITICALCross-site Scripting in org.xwiki.commons:xwiki-commons-xmlEPSS 1.3%CVE-2021-32731MEDIUMThe reset password form reveal users email addressEPSS 1.2%CVE-2023-29214CRITICALorg.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29212CRITICALxwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29210CRITICALorg.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29211CRITICALorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerabilityEPSS 1.2%CVE-2022-36090HIGHorg.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive usersEPSS 1.2%CVE-2023-50723CRITICALXWiki Platform remote code execution/programming rights with configuration section from any user accountEPSS 1.2%CVE-2023-26055CRITICALXWiki Commons may allow privilege escalation to programming rights via user's first nameEPSS 1.2%CVE-2023-29201CRITICALorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityEPSS 1.2%CVE-2023-29526CRITICALAsync and display macro allow displaying and interacting with any document in restricted modeEPSS 1.1%