Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

xwiki-platform Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Published	Severity
`CVE-2026-48048`XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests	Exploitation statusNot known exploited	FixNot confirmed	Published08/10/2026	SeverityHigh
`CVE-2026-48047`XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin	Exploitation statusPublic exploit	FixYes	Published08/07/2026	SeverityMedium
`CVE-2026-33137`XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}	Exploitation statusNot known exploited	FixYes	Published05/20/2026	SeverityCritical
`CVE-2026-40105`XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality	Exploitation statusNot known exploited	FixNot confirmed	Published04/15/2026	SeverityMedium
`CVE-2026-33229`XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API	Exploitation statusNot known exploited	FixYes	Published04/08/2026	SeverityHigh
`CVE-2026-26000`XWiki Platform affected by click-jacking through CSS injection in comments	Exploitation statusNot known exploited	FixYes	Published02/12/2026	SeverityMedium
`CVE-2026-24128`XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages	Exploitation statusNot known exploited	FixYes	Published01/23/2026	SeverityMedium
`CVE-2025-66473`XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis	Exploitation statusPublic exploit	FixYes	Published12/10/2025	SeverityHigh
`CVE-2025-66472`XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication	Exploitation statusNot known exploited	FixYes	Published12/10/2025	SeverityMedium
`CVE-2025-55749`The XWiki Jetty package (XJetty) allows accessing any application file through URL	Exploitation statusNot known exploited	FixYes	Published12/01/2025	SeverityHigh
`CVE-2025-52472`XWiki Platform vulnerable to HQL injection via wiki and space search REST API	Exploitation statusNot known exploited	FixYes	Published10/06/2025	SeverityCritical
`CVE-2025-55748`XWiki Platform's configuration files can be accessed through jsx and sx endpoints	Exploitation statusNot known exploited	FixYes	Published09/03/2025	SeverityCritical
`CVE-2025-55747`XWiki Platform's configuration files can be accessed through the webjars API	Exploitation statusNot known exploited	FixYes	Published09/03/2025	SeverityCritical
`CVE-2025-58049`XWiki PDF export jobs store sensitive cookies unencrypted in job statuses	Exploitation statusNot known exploited	FixYes	Published08/28/2025	SeverityMedium
`CVE-2025-54125`XWiki Platform: Password and email exposure in xml.vm fields	Exploitation statusPublic exploit	FixYes	Published08/05/2025	SeverityHigh
`CVE-2025-54124`XWiki Platform: Any user with editing rights can access password properties through Database List Properties	Exploitation statusPublic exploit	FixYes	Published08/05/2025	SeverityHigh
`CVE-2025-32430`XWiki Platform contains Reflected XSS vulnerability in two templates	Exploitation statusPublic exploit	FixYes	Published08/05/2025	SeverityMedium
`CVE-2025-54385`XWiki Platform's searchDocuments API allows for SQL injection	Exploitation statusNot known exploited	FixYes	Published07/26/2025	SeverityHigh
`CVE-2025-32429`XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter	Exploitation statusNot known exploited	FixYes	Published07/24/2025	SeverityCritical
`CVE-2025-49587`XWiki does not require right warnings for notification displayer objects	Exploitation statusPublic exploit	FixYes	Published06/13/2025	SeverityMedium
`CVE-2025-49586`XWiki allows remote code execution through preview of XClass changes in AWM editor	Exploitation statusPublic exploit	FixYes	Published06/13/2025	SeverityHigh
`CVE-2025-49585`XWiki does not require right warnings for XClass definitions	Exploitation statusNot known exploited	FixYes	Published06/13/2025	SeverityHigh
`CVE-2025-49584`XWiki makes title of inaccessible pages available through the class property values REST API	Exploitation statusPublic exploit	FixYes	Published06/13/2025	SeverityHigh
`CVE-2025-49583`XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right	Exploitation statusPublic exploit	FixYes	Published06/13/2025	SeverityMedium
`CVE-2025-49582`XWiki's required right warnings for macros are incomplete	Exploitation statusNot known exploited	FixNot confirmed	Published06/13/2025	SeverityHigh
`CVE-2025-49581`XWiki allows remote code execution through default value of wiki macro wiki-type parameters	Exploitation statusNot known exploited	FixYes	Published06/13/2025	SeverityHigh
`CVE-2025-49580`XWiki allows privilege escalation through link refactoring	Exploitation statusPublic exploit	FixYes	Published06/13/2025	SeverityHigh
`CVE-2024-56158`XWiki allows SQL injection in query endpoint of REST API with Oracle	Exploitation statusNot known exploited	FixYes	Published06/12/2025	SeverityCritical
`CVE-2025-48063`XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right	Exploitation statusPublic exploit	FixYes	Published05/21/2025	SeverityMedium
`CVE-2025-46554`XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API	Exploitation statusPublic exploit	FixYes	Published04/30/2025	SeverityMedium
`CVE-2025-46557`Any user with view access to the XWiki space can change the authenticator	Exploitation statusNot known exploited	FixYes	Published04/30/2025	SeverityHigh
`CVE-2025-32973`org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right	Exploitation statusPublic exploit	FixYes	Published04/30/2025	SeverityCritical
`CVE-2025-32974`org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type	Exploitation statusPublic exploit	FixYes	Published04/30/2025	SeverityCritical
`CVE-2025-32972`The lesscss script service allows cache clearing without programming right	Exploitation statusPublic exploit	FixYes	Published04/30/2025	SeverityLow
`CVE-2025-32971`XWiki Solr script service doesn't take dropped programming right into account	Exploitation statusPublic exploit	FixYes	Published04/30/2025	SeverityLow
`CVE-2025-32970`org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability	Exploitation statusPublic exploit	FixYes	Published04/30/2025	SeverityMedium
`CVE-2025-32969`org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API	Exploitation statusNot known exploited	FixYes	Published04/23/2025	SeverityCritical
`CVE-2025-32968`org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API	Exploitation statusNot known exploited	FixYes	Published04/23/2025	SeverityHigh
`CVE-2025-32783`XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki	Exploitation statusPublic exploit	FixNo	Published04/16/2025	SeverityMedium
`CVE-2025-29926`The WikiManager REST API allows any user to create wikis	Exploitation statusPublic exploit	FixYes	Published03/19/2025	SeverityHigh
`CVE-2025-29925`XWiki allows unregistered users to access private pages information through REST endpoint	Exploitation statusPublic exploit	FixYes	Published03/19/2025	SeverityHigh
`CVE-2025-29924`XWiki uses the wrong wiki reference in AuthorizationManager	Exploitation statusPublic exploit	FixYes	Published03/19/2025	SeverityHigh
`CVE-2025-24893`Remote code execution as guest via SolrSearchMacros request in xwiki	Exploitation statusKEV	FixYes	Published02/20/2025	SeverityCritical
`CVE-2025-23025`Privilege escalation (PR) through realtime WYSIWYG editing in XWiki	Exploitation statusNot known exploited	FixYes	Published01/14/2025	SeverityCritical
`CVE-2024-55879`XWiki allows RCE from script right in configurable sections	Exploitation statusPublic exploit	FixYes	Published12/12/2024	SeverityCritical
`CVE-2024-55877`XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList	Exploitation statusPublic exploit	FixYes	Published12/12/2024	SeverityCritical
`CVE-2024-55876`XWiki's scheduler in subwiki allows scheduling operations for any main wiki user	Exploitation statusPublic exploit	FixYes	Published12/12/2024	SeverityMedium
`CVE-2024-55663`XWiki Platform has an SQL injection in getdocuments.vm with sort parameter	Exploitation statusNot known exploited	FixYes	Published12/12/2024	SeverityHigh
`CVE-2024-55662`XWiki allows remote code execution through the extension sheet	Exploitation statusPublic exploit	FixYes	Published12/12/2024	SeverityCritical
`CVE-2024-46978`Missing checks for notification filter preferences editions in XWiki Platform	Exploitation statusNot known exploited	FixYes	Published09/18/2024	SeverityMedium
`CVE-2024-46979`Data leak of notification filters of users in XWiki Platform	Exploitation statusNot known exploited	FixYes	Published09/18/2024	SeverityMedium
`CVE-2024-45591`XWiki Platform document history including authors of any page exposed to unauthorized actors	Exploitation statusNot known exploited	FixYes	Published09/10/2024	SeverityMedium
`CVE-2024-43400`XWiki Platform allows XSS through XClass name in string properties	Exploitation statusPublic exploit	FixYes	Published08/19/2024	SeverityCritical
`CVE-2024-43401`In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them	Exploitation statusNot known exploited	FixYes	Published08/19/2024	SeverityCritical
`CVE-2024-41947`XWiki Platform XSS through conflict resolution	Exploitation statusPublic exploit	FixYes	Published07/31/2024	SeverityCritical
`CVE-2024-37901`XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet	Exploitation statusNot known exploited	FixYes	Published07/31/2024	SeverityCritical
`CVE-2024-37900`XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader	Exploitation statusPublic exploit	FixYes	Published07/31/2024	SeverityMedium
`CVE-2024-37898`XWiki Platform vulnerable to document deletion and overwrite from edit	Exploitation statusNot known exploited	FixYes	Published07/31/2024	SeverityMedium
`CVE-2024-38369`XWiki programming rights may be inherited by inclusion	Exploitation statusNot known exploited	FixYes	Published06/24/2024	SeverityCritical
`CVE-2024-37899`Disabling a user account changes its author, allowing RCE from user account in XWiki	Exploitation statusPublic exploit	FixYes	Published06/20/2024	SeverityCritical
`CVE-2024-31997`XWiki Platform remote code execution from account through UIExtension parameters	Exploitation statusNot known exploited	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31988`XWiki Platform CSRF remote code execution through the realtime HTML Converter API	Exploitation statusPublic exploit	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31987`XWiki Platform remote code execution from account via custom skins support	Exploitation statusPublic exploit	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31986`XWiki Platform CSRF remote code execution through scheduler job's document reference	Exploitation statusPublic exploit	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31985`XWiki Platform CSRF in the job scheduler	Exploitation statusNot known exploited	FixYes	Published04/10/2024	SeverityMedium
`CVE-2024-31984`XWiki Platform: Remote code execution through space title and Solr space facet	Exploitation statusPublic exploit	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31983`XWiki Platform: Remote code execution from edit in multilingual wikis via translations	Exploitation statusPublic exploit	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31982`XWiki Platform: Remote code execution as guest via DatabaseSearch	Exploitation statusPublic exploit	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31981`XWiki Platform: Privilege escalation (PR) from user registration through PDFClass	Exploitation statusNot known exploited	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31465`XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet	Exploitation statusNot known exploited	FixYes	Published04/10/2024	SeverityCritical
`CVE-2024-31464`XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted	Exploitation statusPublic exploit	FixNot confirmed	Published04/10/2024	SeverityMedium
`CVE-2024-21648`XWiki has no right protection on rollback action	Exploitation statusNot known exploited	FixYes	Published01/08/2024	SeverityHigh
`CVE-2024-21651`XWiki Denial of Service attack through attachments	Exploitation statusNot known exploited	FixYes	Published01/08/2024	SeverityHigh
`CVE-2024-21650`XWiki Remote Code Execution vulnerability via user registration	Exploitation statusPublic exploit	FixYes	Published01/08/2024	SeverityCritical
`CVE-2023-50732`Velocity execution without script right through tree macro	Exploitation statusNot confirmed	FixYes	Published12/21/2023	SeverityHigh
`CVE-2023-50723`XWiki Platform remote code execution/programming rights with configuration section from any user account	Exploitation statusNot known exploited	FixYes	Published12/15/2023	SeverityCritical
`CVE-2023-50722`XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass	Exploitation statusNot confirmed	FixYes	Published12/15/2023	SeverityCritical
`CVE-2023-50721`XWiki Platform RCE from account through SearchAdmin	Exploitation statusNot confirmed	FixNot confirmed	Published12/15/2023	SeverityCritical
`CVE-2023-50719`XWiki Platform Solr search discloses password hashes of all users	Exploitation statusNot known exploited	FixYes	Published12/15/2023	SeverityHigh
`CVE-2023-50720`XWiki Platform Solr search discloses email addresses of users	Exploitation statusNot confirmed	FixYes	Published12/15/2023	SeverityMedium
`CVE-2023-48241`XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service	Exploitation statusNot confirmed	FixYes	Published11/20/2023	SeverityHigh
`CVE-2023-48240`XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery	Exploitation statusNot confirmed	FixYes	Published11/20/2023	SeverityCritical
`CVE-2023-46243`Code execution via the edit action in XWiki platform	Exploitation statusPublic exploit	FixYes	Published11/07/2023	SeverityCritical
`CVE-2023-46242`Code injection in XWiki Platform	Exploitation statusNot known exploited	FixYes	Published11/07/2023	SeverityCritical
`CVE-2023-46244`Privilege escalation in Xwiki platform	Exploitation statusNot known exploited	FixYes	Published11/07/2023	SeverityCritical
`CVE-2023-46731`Remote code execution through the section parameter in Administration as guest in XWiki Platform	Exploitation statusPublic exploit	FixYes	Published11/06/2023	SeverityCritical
`CVE-2023-46732`Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform	Exploitation statusNot known exploited	FixYes	Published11/06/2023	SeverityCritical
`CVE-2023-45137`XWiki Platform XSS with edit right in the create document form for existing pages	Exploitation statusNot known exploited	FixYes	Published10/25/2023	SeverityCritical
`CVE-2023-45136`XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled	Exploitation statusPublic exploit	FixYes	Published10/25/2023	SeverityCritical
`CVE-2023-45135`XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title	Exploitation statusPublic exploit	FixNot confirmed	Published10/25/2023	SeverityCritical
`CVE-2023-45134`XWiki Platform XSS vulnerability from account in the create page form via template provider	Exploitation statusPublic exploit	FixYes	Published10/25/2023	SeverityCritical
`CVE-2023-37913`org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter	Exploitation statusPublic exploit	FixYes	Published10/25/2023	SeverityCritical
`CVE-2023-37911`org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents	Exploitation statusPublic exploit	FixYes	Published10/25/2023	SeverityMedium
`CVE-2023-37910`org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move	Exploitation statusPublic exploit	FixYes	Published10/25/2023	SeverityHigh
`CVE-2023-37909`Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet	Exploitation statusPublic exploit	FixYes	Published10/25/2023	SeverityCritical
`CVE-2023-41046`Velocity execution without script rights in Xwiki platform	Exploitation statusPublic exploit	FixYes	Published09/01/2023	SeverityMedium
`CVE-2023-40573`XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution	Exploitation statusPublic exploit	FixYes	Published08/24/2023	SeverityCritical
`CVE-2023-40572`XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action	Exploitation statusPublic exploit	FixYes	Published08/24/2023	SeverityCritical
`CVE-2023-40177`XWiki Platform privilege escalation (PR) from account through AWM content fields	Exploitation statusPublic exploit	FixYes	Published08/23/2023	SeverityCritical
`CVE-2023-40176`SXSS in the user profile via the timezone displayer	Exploitation statusNot known exploited	FixYes	Published08/23/2023	SeverityCritical

100 / 230 Results

Security vulnerabilities in xwiki-platform

xwiki-platform

Verify to analyze this security profile

How many security vulnerabilities does xwiki-platform have?

Does the latest xwiki-platform version have known vulnerabilities?

Run an in-depth assessment with complete web risk management