CVE-2026-48048XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests Exploitation status Not known exploited Fix Not confirmed Affected product X xwiki-platform Published 08/10/2026 Severity High CVE-2026-48047XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin Exploitation status Public exploit Fix Affected product X xwiki-platform Published 08/07/2026 Severity Medium CVE-2026-33137XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 05/20/2026 Severity Critical CVE-2026-23734XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash Exploitation status Not known exploited Fix Affected product X xwiki-commons Published 05/20/2026 Severity Critical CVE-2025-51846CryptPad unbounded WebSocket frame flood Exploitation status Not known exploited Fix Affected product C cryptpad Published 04/30/2026 Severity High CVE-2026-40105XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality Exploitation status Not known exploited Fix Not confirmed Affected product X xwiki-platform Published 04/15/2026 Severity Medium CVE-2026-40104XWiki's REST APIs can list all pages/spaces, leading to unavailability Exploitation status Not known exploited Fix Affected product O org.xwiki.platform:xwiki-platform-oldcore Published 04/15/2026 Severity Medium CVE-2026-33229XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/08/2026 Severity High CVE-2025-66024XWiki Blog Application home page vulnerable to Stored XSS via Post Title Exploitation status Public exploit Fix Affected product A application-blog-ui Published 03/04/2026 Severity High CVE-2026-26000XWiki Platform affected by click-jacking through CSS injection in comments Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 02/12/2026 Severity Medium CVE-2026-24128XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 01/23/2026 Severity Medium CVE-2025-65091XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService Exploitation status Not known exploited Fix Affected product M macro-fullcalendar Published 01/10/2026 Severity Critical CVE-2025-65090XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService Exploitation status Not known exploited Fix Affected product M macro-fullcalendar Published 01/10/2026 Severity Medium CVE-2025-66474XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection Exploitation status Public exploit Fix Affected product X xwiki-rendering Published 12/10/2025 Severity High CVE-2025-66473XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis Exploitation status Public exploit Fix Affected product X xwiki-platform Published 12/10/2025 Severity High CVE-2025-66472XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 12/10/2025 Severity Medium CVE-2025-65036XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro Exploitation status Public exploit Fix Affected product X xwiki-pro-macros Published 12/05/2025 Severity High CVE-2025-55749The XWiki Jetty package (XJetty) allows accessing any application file through URL Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 12/01/2025 Severity High CVE-2025-65089XWiki view file macro: User can view content of office file without view rights on the attachment Exploitation status Public exploit Fix Affected product X xwiki-pro-macros Published 11/19/2025 Severity Medium CVE-2025-52472XWiki Platform vulnerable to HQL injection via wiki and space search REST API Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 10/06/2025 Severity Critical CVE-2025-55728XWiki Remote Macros vulnerable to remote code execution using the panel macro Exploitation status Public exploit Fix Not confirmed Affected product X xwiki-pro-macros Published 09/09/2025 Severity Critical CVE-2025-55727XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro Exploitation status Public exploit Fix Not confirmed Affected product X xwiki-pro-macros Published 09/09/2025 Severity Critical CVE-2025-55748XWiki Platform's configuration files can be accessed through jsx and sx endpoints Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 09/03/2025 Severity Critical CVE-2025-55747XWiki Platform's configuration files can be accessed through the webjars API Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 09/03/2025 Severity Critical CVE-2025-58049XWiki PDF export jobs store sensitive cookies unencrypted in job statuses Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 08/28/2025 Severity Medium CVE-2025-51990CVE-2025-51990 Exploitation status Public exploit Fix Not confirmed Affected product Not confirmed Published 08/20/2025 Severity Medium CVE-2025-51991CVE-2025-51991 Exploitation status Public exploit Fix Not confirmed Affected product Not confirmed Published 08/20/2025 Severity High CVE-2025-54125XWiki Platform: Password and email exposure in xml.vm fields Exploitation status Public exploit Fix Affected product X xwiki-platform Published 08/05/2025 Severity High CVE-2025-54124XWiki Platform: Any user with editing rights can access password properties through Database List Properties Exploitation status Public exploit Fix Affected product X xwiki-platform Published 08/05/2025 Severity High CVE-2025-32430XWiki Platform contains Reflected XSS vulnerability in two templates Exploitation status Public exploit Fix Affected product X xwiki-platform Published 08/05/2025 Severity Medium CVE-2025-54385XWiki Platform's searchDocuments API allows for SQL injection Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 07/26/2025 Severity High CVE-2025-32429XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 07/24/2025 Severity Critical CVE-2025-53836XWiki Rendering is vulnerable to RCE attacks when processing nested macros Exploitation status Public exploit Fix Affected product X xwiki-rendering Published 07/14/2025 Severity Critical CVE-2025-53835XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax Exploitation status Public exploit Fix Affected product X xwiki-rendering Published 07/14/2025 Severity Critical CVE-2025-49591CryptPad 2FA Bypass Vulnerability Exploitation status Public exploit Fix Affected product C cryptpad Published 06/18/2025 Severity High CVE-2025-49590CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability Exploitation status Public exploit Fix Affected product C cryptpad Published 06/18/2025 Severity Low CVE-2025-49587XWiki does not require right warnings for notification displayer objects Exploitation status Public exploit Fix Affected product X xwiki-platform Published 06/13/2025 Severity Medium CVE-2025-49586XWiki allows remote code execution through preview of XClass changes in AWM editor Exploitation status Public exploit Fix Affected product X xwiki-platform Published 06/13/2025 Severity High CVE-2025-49585XWiki does not require right warnings for XClass definitions Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 06/13/2025 Severity High CVE-2025-49584XWiki makes title of inaccessible pages available through the class property values REST API Exploitation status Public exploit Fix Affected product X xwiki-platform Published 06/13/2025 Severity High CVE-2025-49583XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right Exploitation status Public exploit Fix Affected product X xwiki-platform Published 06/13/2025 Severity Medium CVE-2025-49582XWiki's required right warnings for macros are incomplete Exploitation status Not known exploited Fix Not confirmed Affected product X xwiki-platform Published 06/13/2025 Severity High CVE-2025-49581XWiki allows remote code execution through default value of wiki macro wiki-type parameters Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 06/13/2025 Severity High CVE-2025-49580XWiki allows privilege escalation through link refactoring Exploitation status Public exploit Fix Affected product X xwiki-platform Published 06/13/2025 Severity High CVE-2024-56158XWiki allows SQL injection in query endpoint of REST API with Oracle Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 06/12/2025 Severity Critical CVE-2025-48063XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right Exploitation status Public exploit Fix Affected product X xwiki-platform Published 05/21/2025 Severity Medium CVE-2025-46554XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/30/2025 Severity Medium CVE-2025-46557Any user with view access to the XWiki space can change the authenticator Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/30/2025 Severity High CVE-2025-46558org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content Exploitation status Public exploit Fix Affected product S syntax-markdown Published 04/30/2025 Severity Critical CVE-2025-32973org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/30/2025 Severity Critical CVE-2025-32974org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/30/2025 Severity Critical CVE-2025-32972The lesscss script service allows cache clearing without programming right Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/30/2025 Severity Low CVE-2025-32971XWiki Solr script service doesn't take dropped programming right into account Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/30/2025 Severity Low CVE-2025-32970org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/30/2025 Severity Medium CVE-2025-32969org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/23/2025 Severity Critical CVE-2025-32968org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/23/2025 Severity High CVE-2025-32783XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/16/2025 Severity Medium CVE-2025-29926The WikiManager REST API allows any user to create wikis Exploitation status Public exploit Fix Affected product X xwiki-platform Published 03/19/2025 Severity High CVE-2025-29925XWiki allows unregistered users to access private pages information through REST endpoint Exploitation status Public exploit Fix Affected product X xwiki-platform Published 03/19/2025 Severity High CVE-2025-29924XWiki uses the wrong wiki reference in AuthorizationManager Exploitation status Public exploit Fix Affected product X xwiki-platform Published 03/19/2025 Severity High CVE-2025-27604XWiki Confluence Migrator Pro's homepage is public Exploitation status Not known exploited Fix Affected product A application-confluence-migrator-pro Published 03/07/2025 Severity High CVE-2025-24893Remote code execution as guest via SolrSearchMacros request in xwiki Exploitation status KEV Fix Affected product X xwiki-platform Published 02/20/2025 Severity Critical CVE-2025-23025Privilege escalation (PR) through realtime WYSIWYG editing in XWiki Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 01/14/2025 Severity Critical CVE-2024-55879XWiki allows RCE from script right in configurable sections Exploitation status Public exploit Fix Affected product X xwiki-platform Published 12/12/2024 Severity Critical CVE-2024-55877XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Exploitation status Public exploit Fix Affected product X xwiki-platform Published 12/12/2024 Severity Critical CVE-2024-55876XWiki's scheduler in subwiki allows scheduling operations for any main wiki user Exploitation status Public exploit Fix Affected product X xwiki-platform Published 12/12/2024 Severity Medium CVE-2024-55663XWiki Platform has an SQL injection in getdocuments.vm with sort parameter Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 12/12/2024 Severity High CVE-2024-55662XWiki allows remote code execution through the extension sheet Exploitation status Public exploit Fix Affected product X xwiki-platform Published 12/12/2024 Severity Critical CVE-2024-52298macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author Exploitation status Public exploit Fix Affected product M macro-pdfviewer Published 11/13/2024 Severity High CVE-2024-52299The PDF viewer macro allows accessing any attachment without access right checks Exploitation status Public exploit Fix Affected product M macro-pdfviewer Published 11/13/2024 Severity High CVE-2024-52300macro-pdfviewer has a XSS through the width parameter Exploitation status Public exploit Fix Affected product M macro-pdfviewer Published 11/13/2024 Severity Critical CVE-2024-46978Missing checks for notification filter preferences editions in XWiki Platform Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 09/18/2024 Severity Medium CVE-2024-46979Data leak of notification filters of users in XWiki Platform Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 09/18/2024 Severity Medium CVE-2024-45591XWiki Platform document history including authors of any page exposed to unauthorized actors Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 09/10/2024 Severity Medium CVE-2024-43400XWiki Platform allows XSS through XClass name in string properties Exploitation status Public exploit Fix Affected product X xwiki-platform Published 08/19/2024 Severity Critical CVE-2024-43401In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 08/19/2024 Severity Critical CVE-2024-42489Pro Macros Remote Code Execution via Viewpdf and similar macros Exploitation status Public exploit Fix Affected product X xwiki-pro-macros Published 08/12/2024 Severity Critical CVE-2024-41947XWiki Platform XSS through conflict resolution Exploitation status Public exploit Fix Affected product X xwiki-platform Published 07/31/2024 Severity Critical CVE-2024-37901XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 07/31/2024 Severity Critical CVE-2024-37900XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader Exploitation status Public exploit Fix Affected product X xwiki-platform Published 07/31/2024 Severity Medium CVE-2024-37898XWiki Platform vulnerable to document deletion and overwrite from edit Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 07/31/2024 Severity Medium CVE-2024-38369XWiki programming rights may be inherited by inclusion Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 06/24/2024 Severity Critical CVE-2024-37899Disabling a user account changes its author, allowing RCE from user account in XWiki Exploitation status Public exploit Fix Affected product X xwiki-platform Published 06/20/2024 Severity Critical CVE-2024-31997XWiki Platform remote code execution from account through UIExtension parameters Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31996XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution Exploitation status Public exploit Fix Affected product X xwiki-commons Published 04/10/2024 Severity Critical CVE-2024-31988XWiki Platform CSRF remote code execution through the realtime HTML Converter API Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31987XWiki Platform remote code execution from account via custom skins support Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31986XWiki Platform CSRF remote code execution through scheduler job's document reference Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31985XWiki Platform CSRF in the job scheduler Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/10/2024 Severity Medium CVE-2024-31984XWiki Platform: Remote code execution through space title and Solr space facet Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31983XWiki Platform: Remote code execution from edit in multilingual wikis via translations Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31982XWiki Platform: Remote code execution as guest via DatabaseSearch Exploitation status Public exploit Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31981XWiki Platform: Privilege escalation (PR) from user registration through PDFClass Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31465XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 04/10/2024 Severity Critical CVE-2024-31464XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted Exploitation status Public exploit Fix Not confirmed Affected product X xwiki-platform Published 04/10/2024 Severity Medium CVE-2024-26138License information is public, exposing instance id and license holder details Exploitation status Not known exploited Fix Affected product A application-licensing Published 02/21/2024 Severity Medium CVE-2024-21648XWiki has no right protection on rollback action Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 01/08/2024 Severity High CVE-2024-21651XWiki Denial of Service attack through attachments Exploitation status Not known exploited Fix Affected product X xwiki-platform Published 01/08/2024 Severity High CVE-2024-21650XWiki Remote Code Execution vulnerability via user registration Exploitation status Public exploit Fix Affected product X xwiki-platform Published 01/08/2024 Severity Critical CVE-2023-50732Velocity execution without script right through tree macro Exploitation status Not confirmed Fix Affected product X xwiki-platform Published 12/21/2023 Severity High 
