← Back

Xwiki

xwiki

Vendor: Xwiki • 248 CVEs

CVEs (248)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-11057
1Xwiki
1Xwiki
Jun 17, 2026
May 12, 2020
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0...Show more
In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0.Show less
CVE-2018-16277
1Xwiki
1Xwiki
Nov 21, 2024
Sep 28, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Image Import function in XWiki through 10.7 has XSS.
CVE-2010-4642
1Xwiki
1Xwiki
Apr 29, 2026
Dec 30, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-4641
1Xwiki
1Xwiki
Apr 29, 2026
Dec 30, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2007-4898
1Xwiki
1Xwiki
Apr 23, 2026
Sep 14, 2007
N/A· v4
N/A· v3
2.1 LOW· v2
Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information v...Show more
Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from third party information.Show less
CVE-2007-4888
1Xwiki
1Xwiki
Apr 23, 2026
Sep 14, 2007
N/A· v4
N/A· v3
3.5 LOW· v2
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users...Show more
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable.Show less
CVE-2006-7223
1Xwiki
1Xwiki
Apr 23, 2026
Sep 14, 2007
N/A· v4
N/A· v3
6.5 MEDIUM· v2
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitr...Show more
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.Show less
CVE-2005-4862
1Xwiki
1Xwiki
Apr 16, 2026
Dec 31, 2005
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information via a search string that matches a password.