Skip to content
Noroxi

xwiki records

282 published records for vendor xwiki.

Researcher profile

Entered KEV
1 · 0.4%
Weaponized
1 · 0.4%
Pre-auth RCE
22
With a fix record
94.3%
Median publish → KEV
252 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

282 records
  • CVE-2025-24893
    99Now

    Remote code execution as guest via SolrSearchMacros request in xwiki

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    xwiki · xwikiFeb 20, 2025

  • CVE-2024-21650
    67This week

    XWiki Remote Code Execution vulnerability via user registration

    CriticalCVSS 9.8Proof of conceptEPSS 93%

    xwiki · xwikiJan 8, 2024

  • CVE-2023-46731
    66This week

    Remote code execution through the section parameter in Administration as guest in XWiki Platform

    CriticalCVSS 9.8No exploitEPSS 88%

    xwiki · xwikiNov 6, 2023

  • CVE-2025-32429
    63This week

    XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

    CriticalCVSS 9.3Proof of conceptEPSS 85%

    xwiki · xwikiJul 24, 2025

  • CVE-2023-37462
    62This week

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui

    HighCVSS 8.8Proof of conceptEPSS 91%

    xwiki · xwikiJul 14, 2023

  • CVE-2025-32969
    61This week

    org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

    CriticalCVSS 9.3Proof of conceptEPSS 80%

    xwiki · xwikiApr 23, 2025

  • CVE-2023-26477
    61This week

    org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 74%

    xwiki · xwikiMar 2, 2023

  • CVE-2024-31984
    60This week

    XWiki Platform: Remote code execution through space title and Solr space facet

    HighCVSS 8.8No exploitEPSS 82%

    xwiki · xwikiApr 10, 2024

  • CVE-2023-36469
    60This week

    Code injection through NotificationRSSService in XWiki Platform

    HighCVSS 8.8No exploitEPSS 82%

    xwiki · xwikiJun 29, 2023

  • CVE-2023-45138
    60This week

    Change Request Application vulnerable to XSS and remote code execution through change request title

    CriticalCVSS 9.6No exploitEPSS 71%

    xwiki · change requestOct 12, 2023

  • CVE-2023-50721
    59Plan

    XWiki Platform RCE from account through SearchAdmin

    HighCVSS 8.8No exploitEPSS 78%

    xwiki · xwikiDec 15, 2023

  • CVE-2023-29525
    58Plan

    Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

    HighCVSS 8.8No exploitEPSS 77%

    xwiki · xwikiApr 19, 2023

  • CVE-2022-36099
    58Plan

    XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

    HighCVSS 8.8No exploitEPSS 76%

    xwiki · xwikiSep 8, 2022

  • CVE-2023-29509
    58Plan

    org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

    HighCVSS 8.8No exploitEPSS 76%

    xwiki · xwikiApr 16, 2023

  • CVE-2023-29524
    58Plan

    Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform

    HighCVSS 8.8No exploitEPSS 75%

    xwiki · xwikiApr 18, 2023

  • CVE-2024-31465
    58Plan

    XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

    HighCVSS 8.8No exploitEPSS 75%

    xwiki · xwikiApr 10, 2024

  • CVE-2024-31997
    57Plan

    XWiki Platform remote code execution from account through UIExtension parameters

    HighCVSS 8.8No exploitEPSS 73%

    xwiki · xwikiApr 10, 2024

  • CVE-2022-36100
    57Plan

    XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

    HighCVSS 8.8No exploitEPSS 73%

    xwiki · xwikiSep 8, 2022

  • CVE-2022-36098
    57Plan

    XWiki Platform Mentions UI vulnerable to Cross-site Scripting

    CriticalCVSS 9.0No exploitEPSS 71%

    xwiki · xwikiSep 8, 2022

  • CVE-2023-32071
    57Plan

    XWiki Platform vulnerable to RXSS via editor parameter - importinline template

    CriticalCVSS 9.0No exploitEPSS 70%

    xwiki · xwikiMay 9, 2023

  • CVE-2023-50719
    55Plan

    XWiki Platform Solr search discloses password hashes of all users

    HighCVSS 7.5Proof of conceptEPSS 83%

    xwiki · xwikiDec 15, 2023

  • CVE-2023-35150
    55Plan

    XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

    HighCVSS 8.0No exploitEPSS 77%

    xwiki · xwikiJun 23, 2023

  • CVE-2023-29516
    55Plan

    Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

    HighCVSS 8.8No exploitEPSS 65%

    xwiki · xwikiApr 18, 2023

  • CVE-2022-36094
    55Plan

    XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

    CriticalCVSS 9.0No exploitEPSS 64%

    xwiki · xwikiSep 8, 2022

  • CVE-2023-26475
    54Plan

    XWiki Platform vulnerable to Remote Code Execution in Annotations

    HighCVSS 8.8No exploitEPSS 63%

    xwiki · xwikiMar 2, 2023