Known vulnerabilities in XWiki platform 6.3-rc-1

Vendor: XWiki
Version: 6.3-rc-1
Software CPE: cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*
Total vulnerabilities: 69
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting XWiki platform version 6.3-rc-1 XWiki platform 6.3-rc-1 is affected by 69 vulnerabilities: 11 high, 40 medium, 18 low Critical High Medium Low

Vulnerabilities (69)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU129892 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-52472
CWE-89 High
No
No
16.10.9, 17.4.2, 17.5.0 05.05.2026 SB2026050582
#VU129877 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-56158
CWE-89 High
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU113355 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-54385
CWE-89 Low
No
No
16.10.6, 17.3.0 rc-1 28.07.2025 SB2025072846
#VU108078 - Incorrect Authorization
CVE-2025-32971
CWE-863 Low
No
No
15.10.13, 16.4.4, 16.8.0 30.04.2025 SB2025043015
#VU108076 - Improper Authorization
CVE-2025-32972
CWE-285 Medium
No
No
15.10.12, 16.4.3, 16.8.0 30.04.2025 SB2025043020
#VU108068 - Missing Authorization
CVE-2025-46554
CWE-862 Medium
No
No
14.10.22, 15.10.12, 16.4.3, 16.7.0 30.04.2025 SB2025043016
#VU129874 - Missing Authorization
CVE-2025-32968
CWE-862 Low
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU129875 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32969
CWE-89 High
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU107581 - Exposure of resource to wrong sphere
CVE-2025-32783
CWE-668 Medium
No
No
- 17.04.2025 SB2025041730
#VU106018 - Improper Authorization
CVE-2025-29926
CWE-285 High
No
No
15.10.15, 16.4.6, 16.10.0 25.03.2025 SB2025032540
#VU106017 - Transmission of Private Resources into a New Sphere ('Resource Leak')
CVE-2025-29925
CWE-402 High
No
No
15.10.14, 16.4.6, 16.10.0 rc-1 25.03.2025 SB2025032539
#VU106016 - Improper Privilege Management
CVE-2025-29924
CWE-269 High
No
No
15.10.14, 16.4.6, 16.10.0 rc-1 25.03.2025 SB2025032539
#VU104143 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-24893
CWE-94 High
Public exploit available
Exploited
15.10.11, 16.4.1 24.02.2025 SB2025022402
#VU125588 - Missing Authorization
CVE-2025-23025
CWE-862 Medium
No
No
15.10.12, 16.4.1 14.01.2025 SB2025022402
SB2025043016
#VU125592 - Missing Authorization
CVE-2024-45591
CWE-862 Medium
No
No
15.10.9 10.09.2024 SB2024121266
#VU96671 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-35162
CWE-79 Low
No
No
14.10.5, 15.1 rc-1 02.09.2024 SB2024090221
#VU96668 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-35159
CWE-79 Low
No
No
14.10.5, 15.1 rc-1 02.09.2024 SB2024090221
#VU126944 - Improper Privilege Management
CVE-2024-43401
CWE-269 Medium
No
No
15.10 19.08.2024 SB20240819171
#VU125593 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-41947
CWE-80 Medium
No
No
15.10.8 31.07.2024 SB2025043018
#VU129904 - Exposure of sensitive information to an unauthorized actor
CVE-2024-31464
CWE-200 Low
No
No
14.10.19, 15.5.4, 15.9 10.04.2024 SB2024041093


Showing elements 1 - 20 out of 69