xwiki
Number 71 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
251
Critical
123
High
67
Known Exploited
1
Exploit available
1
Network, no login needed
34.3%
Of 251 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 12 | 4 | 4 | 4 | 0 | 0 |
| 2025 | 40 | 12 | 17 | 9 | 2 | 0 |
| 2024 | 31 | 20 | 3 | 8 | 0 | 0 |
| 2023 | 112 | 79 | 17 | 15 | 1 | 0 |
| 2022 | 44 | 6 | 20 | 17 | 1 | 0 |
| 2021 | 8 | 1 | 4 | 2 | 1 | 0 |
| 2020 | 4 | 1 | 2 | 1 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| xwiki-platform | 232 | 172 |
| xwiki-commons | 9 | 8 |
| xwiki-rendering | 7 | 7 |
| XWiki Platform | 1 | 1 |
| org.xwiki.platform:xwiki-platform-oldcore | 1 | 1 |
| xwiki | 1 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 35 | 30 |
| Missing Authorization | 25 | 17 |
| Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | 23 | 23 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 21 | 21 |
| Code Injection | 14 | 13 |
| Incorrect Authorization | 11 | 8 |
| Information Disclosure | 10 | 3 |
| Cross-Site Request Forgery | 9 | 6 |
| Exposure of Private Personal Information to an Unauthorized Actor | 8 | 4 |
| Improper Access Control | 6 | 4 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2025-24893 | Remote code execution as guest via SolrSearchMacros request in xwiki | Critical | 100.0% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2025-53837 | org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue | Critical | 1.5% | |
| CVE-2026-53966 | XWiki Platform: Privilege escalation from edit to script right through Live Data editing | High | 0.8% | |
| CVE-2026-34151 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ | High | 2.5% | |
| CVE-2026-48048 | XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests | High | 2.0% | |
| CVE-2026-48047 | XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin | Medium | 0.7% | |
| CVE-2026-33137 | XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} | Critical | 0.6% | |
| CVE-2026-23734 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash | Critical | 18.5% | |
| CVE-2026-40105 | XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality | Medium | 0.5% | |
| CVE-2026-40104 | XWiki's REST APIs can list all pages/spaces, leading to unavailability | High | 0.4% | |
| CVE-2026-33229 | XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API | Critical | 0.5% |