Known vulnerabilities in XWiki platform

Vendor: XWiki
Software CPE: cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*
Total vulnerabilities: 232
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting XWiki platform XWiki platform is affected by 232 known vulnerabilities: 29 high, 148 medium, 55 low Critical High Medium Low

Vulnerabilities (232)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU132086 - Exposure of Private Information ('Privacy Violation')
CVE-2026-48048
CWE-359 Medium
No
No
16.10.17, 17.4.9, 17.10.3 21.05.2026 SB2026052151
#VU132085 - Path Traversal: \'../filedir\'
CVE-2026-48047
CWE-24 Low
No
No
16.10.17, 17.4.9, 17.10.3 21.05.2026 SB2026052151
#VU132084 - Missing Authorization
CVE-2026-33137
CWE-862 Medium
No
No
16.10.17, 17.4.9, 17.10.3, 18.0.1, 18.1.0 21.05.2026 SB2026052151
#VU129897 - Allocation of Resources Without Limits or Throttling
CVE-2026-40104
CWE-770 Medium
No
No
16.10.16, 17.4.8, 17.10.1 05.05.2026 SB2026050585
#VU129896 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2026-40105
CWE-80 High
No
No
16.10.16, 17.4.8, 17.10.1 05.05.2026 SB2026050585
#VU129895 - Improper Restriction of Rendered UI Layers or Frames
CVE-2026-26000
CWE-1021 Medium
No
No
16.10.13, 17.4.6, 17.9.0 05.05.2026 SB2026050584
#VU129894 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2025-66472
CWE-80 High
No
No
16.10.10, 17.4.2 05.05.2026 SB2026050582
#VU129893 - Allocation of Resources Without Limits or Throttling
CVE-2025-66473
CWE-770 Medium
No
No
16.10.11, 17.4.4, 17.7.0 05.05.2026 SB2026050583
#VU129892 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-52472
CWE-89 High
No
No
16.10.9, 17.4.2, 17.5.0 05.05.2026 SB2026050582
#VU129891 - Relative Path Traversal
CVE-2025-55747
CWE-23 High
No
No
16.10.7, 17.4.0 05.05.2026 SB2026050581
#VU129890 - Relative Path Traversal
CVE-2025-55748
CWE-23 High
No
No
16.10.7, 17.4.0 05.05.2026 SB2026050581
#VU129889 - Improper Removal of Sensitive Information Before Storage or Transfer
CVE-2025-58049
CWE-212 Low
No
No
16.4.8, 16.10.7, 17.4.0 05.05.2026 SB2026050581
#VU129886 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-32430
CWE-79 Medium
No
No
16.4.8, 16.10.6, 17.3.0 rc-1 05.05.2026 SB2026050581
#VU129880 - Improper Access Control
CVE-2025-49584
CWE-284 Medium
No
No
16.4.7, 16.10.3, 17.0.0 05.05.2026 SB2026050580
#VU129879 - Incorrect Authorization
CVE-2025-49582
CWE-863 Medium
No
No
16.4.7, 16.10.3, 17.0.0 05.05.2026 SB2026050580
#VU129878 - Incorrect Privilege Assignment
CVE-2025-49580
CWE-266 Medium
No
No
16.4.7, 16.10.4, 17.1.0 05.05.2026 SB2026050580
#VU129877 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-56158
CWE-89 High
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU129876 - Improper Access Control
CVE-2025-48063
CWE-284 Low
No
No
16.10.4, 17.1.0 05.05.2026 SB2026050580
#VU129874 - Missing Authorization
CVE-2025-32968
CWE-862 Low
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU129875 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32969
CWE-89 High
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580


Showing elements 1 - 20 out of 232