Known vulnerabilities in XWiki platform 9.4-rc-1

Vendor: XWiki
Version: 9.4-rc-1
Software CPE: cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*
Total vulnerabilities: 70
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting XWiki platform version 9.4-rc-1 XWiki platform 9.4-rc-1 is affected by 70 vulnerabilities: 8 high, 44 medium, 18 low Critical High Medium Low

Vulnerabilities (70)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU129892 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-52472
CWE-89 High
No
No
16.10.9, 17.4.2, 17.5.0 05.05.2026 SB2026050582
#VU129877 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-56158
CWE-89 High
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU122033 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24128
CWE-79 Low
No
No
16.10.12, 17.4.5, 17.8.0 rc-1 26.01.2026 SB2026012636
#VU113222 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32429
CWE-89 High
Public exploit available
No
16.10.6, 17.3.0 rc-1 25.07.2025 SB2025072519
#VU129874 - Missing Authorization
CVE-2025-32968
CWE-862 Low
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU129875 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32969
CWE-89 High
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU125588 - Missing Authorization
CVE-2025-23025
CWE-862 Medium
No
No
15.10.12, 16.4.1 14.01.2025 SB2025022402
SB2025043016
#VU125592 - Missing Authorization
CVE-2024-45591
CWE-862 Medium
No
No
15.10.9 10.09.2024 SB2024121266
#VU96671 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-35162
CWE-79 Low
No
No
14.10.5, 15.1 rc-1 02.09.2024 SB2024090221
#VU96668 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-35159
CWE-79 Low
No
No
14.10.5, 15.1 rc-1 02.09.2024 SB2024090221
#VU126944 - Improper Privilege Management
CVE-2024-43401
CWE-269 Medium
No
No
15.10 19.08.2024 SB20240819171
#VU125593 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-41947
CWE-80 Medium
No
No
15.10.8 31.07.2024 SB2025043018
#VU129904 - Exposure of sensitive information to an unauthorized actor
CVE-2024-31464
CWE-200 Low
No
No
14.10.19, 15.5.4, 15.9 10.04.2024 SB2024041093
#VU129911 - Improper Handling of Insufficient Privileges
CVE-2024-21648
CWE-274 Medium
No
No
14.10.17, 15.5.3, 15.8 08.01.2024 SB2024010844
#VU129971 - Improper Access Control
CVE-2023-29513
CWE-284 Low
No
No
14.10.1, 15.0 18.04.2023 SB2022112156
#VU129968 - Eval Injection
CVE-2023-29516
CWE-95 Medium
No
No
13.10.11, 14.4.8, 14.10.1, 15.0 18.04.2023 SB2022112156
#VU129967 - Exposure of sensitive information to an unauthorized actor
CVE-2023-29517
CWE-200 Medium
No
No
13.10.11, 14.4.8, 14.10.1, 15.0 18.04.2023 SB2022112156
#VU129965 - Eval Injection
CVE-2023-29518
CWE-95 Medium
No
No
13.10.11, 14.4.8, 14.10.1, 15.0 18.04.2023 SB2022112156
#VU129964 - Uncaught Exception
CVE-2023-29520
CWE-248 Low
No
No
13.10.11, 14.4.8, 14.10.1, 15.0 18.04.2023 SB2022112156
#VU129961 - Eval Injection
CVE-2023-29522
CWE-95 Medium
No
No
14.4.8, 14.10.3, 15.0 18.04.2023 SB2022112156


Showing elements 1 - 20 out of 70