Known vulnerabilities in XWiki platform 11.4-rc-1

Vendor: XWiki
Version: 11.4-rc-1
Software CPE: cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*
Total vulnerabilities: 95
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting XWiki platform version 11.4-rc-1 XWiki platform 11.4-rc-1 is affected by 95 vulnerabilities: 14 high, 58 medium, 23 low Critical High Medium Low

Vulnerabilities (95)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU129892 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-52472
CWE-89 High
No
No
16.10.9, 17.4.2, 17.5.0 05.05.2026 SB2026050582
#VU129880 - Improper Access Control
CVE-2025-49584
CWE-284 Medium
No
No
16.4.7, 16.10.3, 17.0.0 05.05.2026 SB2026050580
#VU129877 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-56158
CWE-89 High
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU122033 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24128
CWE-79 Low
No
No
16.10.12, 17.4.5, 17.8.0 rc-1 26.01.2026 SB2026012636
#VU113355 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-54385
CWE-89 Low
No
No
16.10.6, 17.3.0 rc-1 28.07.2025 SB2025072846
#VU113222 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32429
CWE-89 High
Public exploit available
No
16.10.6, 17.3.0 rc-1 25.07.2025 SB2025072519
#VU108078 - Incorrect Authorization
CVE-2025-32971
CWE-863 Low
No
No
15.10.13, 16.4.4, 16.8.0 30.04.2025 SB2025043015
#VU108076 - Improper Authorization
CVE-2025-32972
CWE-285 Medium
No
No
15.10.12, 16.4.3, 16.8.0 30.04.2025 SB2025043020
#VU108068 - Missing Authorization
CVE-2025-46554
CWE-862 Medium
No
No
14.10.22, 15.10.12, 16.4.3, 16.7.0 30.04.2025 SB2025043016
#VU129874 - Missing Authorization
CVE-2025-32968
CWE-862 Low
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU129875 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32969
CWE-89 High
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU107581 - Exposure of resource to wrong sphere
CVE-2025-32783
CWE-668 Medium
No
No
- 17.04.2025 SB2025041730
#VU106018 - Improper Authorization
CVE-2025-29926
CWE-285 High
No
No
15.10.15, 16.4.6, 16.10.0 25.03.2025 SB2025032540
#VU106017 - Transmission of Private Resources into a New Sphere ('Resource Leak')
CVE-2025-29925
CWE-402 High
No
No
15.10.14, 16.4.6, 16.10.0 rc-1 25.03.2025 SB2025032539
#VU106016 - Improper Privilege Management
CVE-2025-29924
CWE-269 High
No
No
15.10.14, 16.4.6, 16.10.0 rc-1 25.03.2025 SB2025032539
#VU104143 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-24893
CWE-94 High
Public exploit available
Exploited
15.10.11, 16.4.1 24.02.2025 SB2025022402
#VU125588 - Missing Authorization
CVE-2025-23025
CWE-862 Medium
No
No
15.10.12, 16.4.1 14.01.2025 SB2025022402
SB2025043016
#VU125592 - Missing Authorization
CVE-2024-45591
CWE-862 Medium
No
No
15.10.9 10.09.2024 SB2024121266
#VU96668 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-35159
CWE-79 Low
No
No
14.10.5, 15.1 rc-1 02.09.2024 SB2024090221
#VU125593 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-41947
CWE-80 Medium
No
No
15.10.8 31.07.2024 SB2025043018


Showing elements 1 - 20 out of 95