High
CVE-2026-34151
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 47
Reset filters
Medium
CVE-2026-40104
XWiki's REST APIs can list all pages/spaces, leading to unavailability
High
CVE-2026-33229
XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
High
CVE-2025-66474
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
High
CVE-2025-54125
XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
High
CVE-2025-54124
XWiki leaks password hashes and other accessible password properties
High
CVE-2025-54385
XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
High
CVE-2025-49586
XWiki allows remote code execution through preview of XClass changes in AWM editor
Critical
CVE-2024-56158
XWiki allows SQL injection in query endpoint of REST API with Oracle
High
CVE-2025-32968
org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
Critical
CVE-2024-43400
XWiki Platform allows XSS through XClass name in string properties
Medium
CVE-2024-37898
XWiki Platform vulnerable to document deletion and overwrite from edit
Critical
CVE-2024-37899
XWiki Platform allows remote code execution from user account
Critical
CVE-2024-31987
XWiki Platform remote code execution from account via custom skins support
Critical
CVE-2024-31981
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
Medium
CVE-2024-31464
XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted
High
CVE-2024-21648
XWiki has no right protection on rollback action
High
CVE-2023-46243
XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
Critical
CVE-2023-46242
XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
Medium
CVE-2023-37911
org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents
Medium
CVE-2023-41046
Velocity execution without script right through VelocityCode and VelocityWiki property
High
CVE-2023-40572
XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
Critical
CVE-2023-36468
Upgrading doesn't prevent exploiting vulnerable XWiki documents
High
CVE-2023-35157
XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.