Skip to content
OpenAdvisories

Vendor

xwiki

250 known vulnerabilities.

Products

xwiki-platform 233 xwiki-commons 9 xwiki-rendering 7 org.xwiki.platform:xwiki-platform-oldcore 1 org.xwiki.platform:xwiki-platform-legacy-oldcore 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.6
    CVE-2026-33229 Public exploit

    XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting AP…

    xwiki org.xwiki.platform xwiki-platform xwiki-platform-oldcore Maven
  • High 7.5
    CVE-2022-24897 Public exploit

    Arbitrary filesystem write access from Velocity

    APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read o…

    xwiki xwiki-commons org.xwiki.commons:xwiki-commons-velocity Maven
  • High 7.7
    CVE-2021-21380 Public exploit

    Rating Script Service expose XWiki to SQL injection

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests wi…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-ratings-api Maven