Xwiki Security Vulnerabilities (CVEs)

This vulnerability in XWiki Platform allows any user who can edit a wiki page to gain programming rights through missing escaping in administration in...

This vulnerability in XWiki Platform allows authenticated users to inject malicious XWiki syntax containing script macros through the search administr...

This vulnerability in XWiki Platform allows attackers to steal login and session cookies via image embedding in rendered diffs, enabling user imperson...

This is a critical CSRF vulnerability in XWiki Admin Tools that allows attackers to execute arbitrary shell commands on the server by tricking adminis...

This vulnerability in XWiki Platform allows authenticated users with edit rights to execute arbitrary Groovy code on the server by exploiting improper...

CVE-2023-46242 is a critical vulnerability in XWiki Platform that allows authenticated users with programming privileges to execute arbitrary content ...

CVE-2023-46731 is a critical remote code execution vulnerability in XWiki Platform where improper escaping of the section URL parameter allows attacke...

This is a stored cross-site scripting (XSS) vulnerability in XWiki Platform that allows attackers to inject malicious scripts into error messages when...

This vulnerability allows reflected cross-site scripting (XSS) in XWiki's page creation form when document name validation is enabled. An attacker can...

This is a stored cross-site scripting (XSS) vulnerability in XWiki Platform that allows attackers with user accounts to inject malicious JavaScript in...

CVE-2023-37908 is a cross-site scripting (XSS) vulnerability in XWiki Rendering that allows attackers to inject arbitrary HTML/JavaScript via maliciou...

This vulnerability in XWiki's footnote macro allows privilege escalation from a standard user account to programming rights, leading to remote code ex...

This vulnerability in XWiki's Identity OAuth UI component allows attackers to inject malicious scripts and XWiki syntax via OAuth login parameters. Su...

CVE-2023-40572 is a Cross-Site Request Forgery (CSRF) vulnerability in XWiki Platform's create action that allows attackers to execute arbitrary scrip...

This vulnerability allows any registered user in XWiki Platform to execute arbitrary scripts with programming rights via their user profile content fi...

This stored XSS vulnerability in XWiki Platform allows any registered user to inject malicious JavaScript into their time zone preference, which execu...

This vulnerability allows any user with view access to the Invitation.WebHome page in XWiki Platform to execute arbitrary script macros, including Gro...

This vulnerability in XWiki Platform allows attackers with view rights on the SkinsCode.XWikiSkinsSheet document to escalate privileges to programming...

This CVE describes a Cross-Site Request Forgery (CSRF) vulnerability in XWiki Platform's REST API that allows attackers to execute arbitrary code when...

This vulnerability allows any user with edit rights in XWiki Platform to edit all pages in the CKEditor space, enabling harmful actions like deleting ...

XWiki Platform retains vulnerable old document revisions after upgrades, allowing attackers to exploit previously fixed vulnerabilities by accessing s...

CVE-2023-36470 is a critical remote code execution vulnerability in XWiki Platform that allows attackers to inject and execute malicious code with pro...

XWiki Commons HTML sanitizer vulnerability allows attackers without script rights to create phishing forms or embed malicious inputs that could lead t...

This is a cross-site scripting (XSS) vulnerability in XWiki Platform that allows attackers to inject malicious JavaScript via specially crafted URLs. ...

This is a cross-site scripting (XSS) vulnerability in XWiki Platform that allows attackers to inject malicious JavaScript via specially crafted URLs. ...

This vulnerability allows attackers to inject malicious JavaScript into XWiki pages by crafting URLs with payloads in the resubmit template parameters...

This is a cross-site scripting (XSS) vulnerability in XWiki Platform that allows attackers to inject malicious JavaScript via specially crafted URLs. ...

This stored cross-site scripting (XSS) vulnerability in XWiki Platform allows users with edit rights to inject malicious scripts into wiki pages. When...

This vulnerability allows any user with view rights on any document in XWiki Platform to execute arbitrary code with programming rights, leading to re...

This vulnerability allows any logged-in XWiki user to inject malicious code into their first name field, which executes with programming rights. This ...

This vulnerability allows any logged-in user in XWiki Platform to modify mail configuration settings, including viewing and editing SMTP credentials. ...

This stored cross-site scripting (XSS) vulnerability in XWiki Platform allows users with document editing permissions to inject malicious HTML code. W...

This vulnerability in XWiki Platform allows attackers to execute arbitrary wiki content with the privileges of the TipsPanel author by creating a mali...

This vulnerability in XWiki Platform allows attackers to inject malicious scripts through HTML attributes and link URLs, enabling cross-site scripting...

This CVE allows authenticated users in XWiki Platform to execute arbitrary code with the privileges of the XWiki.ClassSheet document author, potential...

This vulnerability in XWiki's XML library allows attackers to inject arbitrary HTML code through invalid data attributes, leading to cross-site script...

This vulnerability allows cross-site scripting (XSS) via invalid HTML comments in XWiki's restricted HTML cleaner mode. When exploited, it enables Jav...

This vulnerability allows authenticated users without script or programming rights to execute arbitrary Groovy code on XWiki servers by adding malicio...

This vulnerability in XWiki Platform allows attackers to bypass access controls and execute arbitrary code through specially crafted comments containi...

This vulnerability allows any user with edit access to at least one document (including their own profile by default) to inject malicious code through...

CVE-2023-29514 is a critical remote code execution vulnerability in XWiki Platform where any user with document edit rights can execute arbitrary code...

CVE-2023-29516 is a critical remote code execution vulnerability in XWiki Platform where any user with view rights on the XWiki.AttachmentSelector pag...

This vulnerability allows any user with view rights in XWiki Platform to execute arbitrary Groovy, Python, or Velocity code, leading to full compromis...