xwiki/xwiki-platform Security Advisories | GitStock

high2025-07-25

XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

GHSA-p9qm-p942-q3w5 · CVE-2025-54385

critical2025-07-24

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

GHSA-vr59-gm53-v7cq · CVE-2025-32429

high2025-06-13

XWiki does not require right warnings for XClass definitions

GHSA-59w6-r9hm-439h · CVE-2025-49585

high2025-06-13

XWiki allows remote code execution through preview of XClass changes in AWM editor

GHSA-jp4x-w9cj-97q7 · CVE-2025-49586

medium2025-06-13

XWiki does not require right warnings for notification displayer objects

GHSA-j7p2-87q3-44w7 · CVE-2025-49587

high2025-06-13

XWiki makes title of inaccessible pages available through the class property values REST API

GHSA-mvp5-qx9c-c3fv · CVE-2025-49584

medium2025-06-13

XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

GHSA-ff6v-w58f-v97w · CVE-2025-49583

high2025-06-13

XWiki allows remote code execution through default value of wiki macro wiki-type parameters

GHSA-9875-cw22-f7cx · CVE-2025-49581

high2025-06-13

XWiki's required right warnings for macros are incomplete

GHSA-c32m-27pj-4xcj · CVE-2025-49582

high2025-06-13

XWiki allows privilege escalation through link refactoring

GHSA-jm43-hrq7-r7w6 · CVE-2025-49580

critical2025-06-12

XWiki allows SQL injection in query endpoint of REST API with Oracle

GHSA-prwh-7838-xf82 · CVE-2024-56158

medium2025-05-21

XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right

GHSA-rhfv-688c-p6hp · CVE-2025-48063

high2025-04-30

Any user with view access to the XWiki space can change the authenticator

GHSA-f9c6-2f9p-82jj · CVE-2025-46557

medium2025-04-30

XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

GHSA-r5cr-xm48-97xp · CVE-2025-46554

critical2025-04-29

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

GHSA-mvgm-3rw2-7j4r · CVE-2025-32974

critical2025-04-29

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

GHSA-x7wv-5qg4-vmr6 · CVE-2025-32973

low2025-04-29

The lesscss script service allows cache clearing without programming right

GHSA-rp38-24m3-rx87 · CVE-2025-32972

low2025-04-29

Solr script service doesn't take dropped programming right into account

GHSA-987p-r3jc-8c8v · CVE-2025-32971

medium2025-04-29

org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability

GHSA-pjhg-9wr9-rj96 · CVE-2025-32970

critical2025-04-23

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

GHSA-f69v-xrj8-rhxf · CVE-2025-32969