Vulnerabilidades em xwiki

250 resultados
Análise Vexday

O XWiki acumula 245 CVEs catalogadas, das quais 121 são classificadas como severidade crítica — concentração expressiva que merece atenção contínua de equipes de gestão de vulnerabilidades. A taxa de exploração ativa está em linha com a média geral do catálogo, mas o CVE-2025-24893 se destaca com EPSS de 0,999, indicando probabilidade máxima de exploração ativa segundo os modelos preditivos, e já figura no catálogo KEV da CISA. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que costuma refletir gaps estruturais no tratamento de entrada e saída de dados na plataforma. Com 9 CVEs com PoC pública e 5 surgidas nos últimos 90 dias, o ritmo de descoberta recente reforça a necessidade de monitoramento contínuo e aplicação prioritária de patches.

CVE-2024-31987CRITICALXWiki Platform remote code execution from account via custom skins supportEPSS 1.4%CVE-2023-29202CRITICALorg.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityEPSS 1.4%CVE-2023-29207HIGHImproper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroEPSS 1.4%CVE-2022-41934CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-uiEPSS 1.4%CVE-2023-37913CRITICALorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converterEPSS 1.4%CVE-2021-21380HIGHRating Script Service expose XWiki to SQL injectionEPSS 1.3%CVE-2020-15171MEDIUMUsers with SCRIPT rights can execute arbitrary code in XWikiEPSS 1.3%CVE-2022-29251HIGHCross-site Scripting in the Flamingo theme managerEPSS 1.3%CVE-2022-41931CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-uiEPSS 1.3%CVE-2023-29528CRITICALCross-site Scripting in org.xwiki.commons:xwiki-commons-xmlEPSS 1.3%CVE-2021-32731MEDIUMThe reset password form reveal users email addressEPSS 1.2%CVE-2023-29212CRITICALxwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2022-36090HIGHorg.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive usersEPSS 1.2%CVE-2023-29214CRITICALorg.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29210CRITICALorg.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29211CRITICALorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerabilityEPSS 1.2%CVE-2023-50723CRITICALXWiki Platform remote code execution/programming rights with configuration section from any user accountEPSS 1.2%CVE-2023-26055CRITICALXWiki Commons may allow privilege escalation to programming rights via user's first nameEPSS 1.2%CVE-2023-29201CRITICALorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityEPSS 1.2%CVE-2023-29512CRITICALCode injection in xwiki-platform-web-templatesEPSS 1.1%