Patchfirst
Patchfirst

Vendor

xwiki

1 of 41 xwiki CVEs in Patchfirst (2%) are in of vulnerabilities exploited in the wild.

CVEs
41
In CISA KEV
12%
Known ransomware use
0
Median days to KEV
252
from publication
Latest KEV listing
30 Oct 2025
Watch xwiki Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • Platform In KEV: 1 CVEs: 1
  • xwiki-platform In KEV: 0 CVEs: 40

Top ATT&CK techniques

What attackers do with xwiki CVEs
Open in ATT&CK Navigator

Counts are xwiki CVEs linked to the technique. Each link’s provenance is on the CVE page.

xwiki CVEs

41 CVEs, by priority
  1. CVE-2023-37462Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in…
    xwiki · xwiki-platformPublic exploitCritical · 10.0
    91.6%Top 0.19%
    77.0priority
  2. CVE-2025-32429XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
    xwiki · xwiki-platformPublic exploitCritical · 9.3
    85.5%Top 0.28%
    71.5priority
  3. CVE-2025-24893XWiki Platform Eval Injection Vulnerability
    XWiki · PlatformKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    >99.9%Top 0.02%
    69.9priority
  4. CVE-2025-52472XWiki Platform vulnerable to HQL injection via wiki and space search REST API
    xwiki · xwiki-platformPublic exploitCritical · 9.3
    2.4%Top 16%
    68.3priority
  5. CVE-2025-55748XWiki Platform's configuration files can be accessed through jsx and sx endpoints
    xwiki · xwiki-platformPublic exploitCritical · 9.3
    1.8%Top 22%
    67.1priority
  6. CVE-2024-21650XWiki Remote Code Execution vulnerability via user registration
    xwiki · xwiki-platformPublic exploitCritical · 10.0
    93.5%Top 0.16%
    67.0priority
  7. CVE-2025-55747XWiki Platform's configuration files can be accessed through the webjars API
    xwiki · xwiki-platformPublic exploitCritical · 9.3
    1.7%Top 23%
    66.9priority
  8. CVE-2024-31982XWiki Platform: Remote code execution as guest via DatabaseSearch
    xwiki · xwiki-platformPublic exploitCritical · 10.0
    34.5%Top 1.6%
    66.7priority
  9. CVE-2025-32969org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
    xwiki · xwiki-platformPublic exploitCritical · 9.3
    80.0%Top 0.39%
    66.4priority
  10. CVE-2025-55749The XWiki Jetty package (XJetty) allows accessing any application file through URL
    xwiki · xwiki-platformPublic exploitHigh · 8.7
    1.5%Top 26%
    65.8priority
  11. CVE-2023-46732Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform
    xwiki · xwiki-platformPublic exploitCritical · 9.7
    2.2%Top 18%
    63.3priority
  12. CVE-2025-54125XWiki Platform: Password and email exposure in xml.vm fields
    xwiki · xwiki-platformPublic exploitHigh · 8.7
    1.5%Top 27%
    60.8priority
  13. CVE-2025-29925XWiki allows unregistered users to access private pages information through REST endpoint
    xwiki · xwiki-platformPublic exploitHigh · 8.7
    0.9%Top 39%
    58.3priority
  14. CVE-2025-46554XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
    xwiki · xwiki-platformPublic exploitMedium · 5.3
    1.0%Top 36%
    56.5priority
  15. CVE-2025-32970org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
    xwiki · xwiki-platformPublic exploitMedium · 6.1
    0.6%Top 52%
    53.9priority
  16. CVE-2023-50719XWiki Platform Solr search discloses password hashes of all users
    xwiki · xwiki-platformPublic exploitHigh · 7.5
    83.5%Top 0.31%
    30.2priority
  17. CVE-2023-48241XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service
    xwiki · xwiki-platformPublic exploitHigh · 7.5
    72.8%Top 0.55%
    30.1priority
  18. CVE-2023-50720XWiki Platform Solr search discloses email addresses of users
    xwiki · xwiki-platformPublic exploitMedium · 5.3
    59.1%Top 0.89%
    28.5priority
  19. CVE-2023-32068URL Redirection to Untrusted Site in XWiki
    xwiki · xwiki-platformPublic exploitMedium · 4.7
    55.1%Top 0.97%
    28.1priority
  20. CVE-2023-46731Remote code execution through the section parameter in Administration as guest in XWiki Platform
    xwiki · xwiki-platformCritical · 10.0
    88.5%Top 0.23%
    27.0priority
  21. CVE-2024-31997XWiki Platform remote code execution from account through UIExtension parameters
    xwiki · xwiki-platformCritical · 10.0
    73.9%Top 0.52%
    26.9priority
  22. CVE-2024-31984XWiki Platform: Remote code execution through space title and Solr space facet
    xwiki · xwiki-platformCritical · 10.0
    83.0%Top 0.33%
    26.9priority
  23. CVE-2024-31465XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
    xwiki · xwiki-platformCritical · 10.0
    75.6%Top 0.48%
    26.9priority
  24. CVE-2023-50721XWiki Platform RCE from account through SearchAdmin
    xwiki · xwiki-platformCritical · 10.0
    78.8%Top 0.41%
    26.9priority
  25. CVE-2023-36469Code injection through NotificationRSSService in XWiki Platform
    xwiki · xwiki-platformCritical · 10.0
    82.0%Top 0.35%
    26.9priority
  26. CVE-2023-29524Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform
    xwiki · xwiki-platformCritical · 10.0
    75.7%Top 0.48%
    26.9priority
  27. CVE-2023-29525Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform
    xwiki · xwiki-platformCritical · 10.0
    77.8%Top 0.43%
    26.9priority
  28. CVE-2023-29509org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
    xwiki · xwiki-platformCritical · 10.0
    76.2%Top 0.47%
    26.9priority
  29. CVE-2023-26477org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
    xwiki · xwiki-platformCritical · 10.0
    74.8%Top 0.5%
    26.9priority
  30. CVE-2023-35150XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
    xwiki · xwiki-platformCritical · 9.9
    77.7%Top 0.44%
    26.8priority
  31. CVE-2023-35166Privilege escalation (PR) from account through TipsPanel
    xwiki · xwiki-platformCritical · 10.0
    62.2%Top 0.82%
    26.8priority
  32. CVE-2023-29516Code injection from view right on XWiki.AttachmentSelector in xwiki-platform
    xwiki · xwiki-platformCritical · 9.9
    65.9%Top 0.73%
    26.8priority
  33. CVE-2023-26475XWiki Platform vulnerable to Remote Code Execution in Annotations
    xwiki · xwiki-platformCritical · 10.0
    63.6%Top 0.79%
    26.8priority
  34. CVE-2022-36100XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
    xwiki · xwiki-platformCritical · 9.9
    73.6%Top 0.53%
    26.8priority
  35. CVE-2022-36099XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
    xwiki · xwiki-platformCritical · 9.9
    76.3%Top 0.46%
    26.8priority
  36. CVE-2023-40176SXSS in the user profile via the timezone displayer
    xwiki · xwiki-platformCritical · 9.1
    80.0%Top 0.39%
    26.3priority
  37. CVE-2023-32071XWiki Platform vulnerable to RXSS via editor parameter - importinline template
    xwiki · xwiki-platformCritical · 9.1
    70.4%Top 0.61%
    26.2priority
  38. CVE-2022-36098XWiki Platform Mentions UI vulnerable to Cross-site Scripting
    xwiki · xwiki-platformHigh · 8.9
    71.6%Top 0.58%
    26.1priority
  39. CVE-2022-36096XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
    xwiki · xwiki-platformHigh · 8.9
    60.2%Top 0.86%
    26.1priority
  40. CVE-2022-36094XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
    xwiki · xwiki-platformHigh · 8.9
    64.8%Top 0.76%
    26.1priority
  41. CVE-2022-36097XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
    xwiki · xwiki-platformHigh · 8.9
    58.2%Top 0.91%
    26.0priority
↑ ↓ chooseEnter openEsc close