Skip to content
OpenAdvisories

Product · xwiki

xwiki-platform

233 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.6
    CVE-2026-33229 Public exploit

    XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting AP…

    xwiki org.xwiki.platform xwiki-platform xwiki-platform-oldcore Maven
  • Critical 9.3
    CVE-2025-32429 Public exploit Scanner template EPSS 85%

    XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocu…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-distribution-war Maven
  • Critical 9.8
    CVE-2025-24893 Exploited Public exploit Scanner template EPSS 100%

    Remote code execution as guest via SolrSearchMacros request in xwiki

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of t…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-search-solr-ui Maven
    KEV Oct 30, 2025
  • Critical 9.1
    CVE-2024-43400 Public exploit

    XWiki Platform allows XSS through XClass name in string properties

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven
  • Critical 9.1
    CVE-2024-41947 Public exploit

    XWiki Platform XSS through conflict resolution

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the ot…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-web-templates Maven
  • Critical 10.0
    CVE-2024-31982 Public exploit Scanner template EPSS 35%

    XWiki Platform: Remote code execution as guest via DatabaseSearch

    XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visit…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-search-ui Maven
  • High 7.7
    CVE-2021-21380 Public exploit

    Rating Script Service expose XWiki to SQL injection

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests wi…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-ratings-api Maven