Known vulnerabilities in XWiki platform - page 2

Vendor: XWiki
Software CPE: cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*
Total vulnerabilities: 232
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting XWiki platform XWiki platform is affected by 232 known vulnerabilities: 29 high, 148 medium, 55 low Critical High Medium Low

Vulnerabilities (232)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU129888 - Exposure of Private Information ('Privacy Violation')
CVE-2025-54124
CWE-359 Low
No
No
16.4.7, 16.10.5, 17.2.0 05.05.2026 SB2026050580
#VU129887 - Exposure of Private Information ('Privacy Violation')
CVE-2025-54125
CWE-359 Medium
No
No
16.4.7, 16.10.5, 17.2.0 05.05.2026 SB2026050580
#VU129885 - Improper Authorization
CVE-2025-49585
CWE-285 Medium
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU129884 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49587
CWE-79 Low
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU129883 - Improper Authorization
CVE-2025-49583
CWE-285 Low
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU129882 - Improper Access Control
CVE-2025-49586
CWE-284 Medium
No
No
16.4.7, 16.10.3, 17.0.0 05.05.2026 SB2026050580
#VU129881 - Improper Privilege Management
CVE-2025-49581
CWE-269 Medium
No
No
16.4.7, 16.10.3, 17.0.0 05.05.2026 SB2026050580
#VU125784 - Missing Authorization
CVE-2026-33229
CWE-862 Low
No
No
17.4.8, 17.10.1 10.04.2026 SB2026041060
#VU122033 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24128
CWE-79 Low
No
No
16.10.12, 17.4.5, 17.8.0 rc-1 26.01.2026 SB2026012636
#VU118875 - Improper Access Control
CVE-2025-55749
CWE-284 Medium
No
No
16.10.11, 17.4.4, 17.7.0 01.12.2025 SB2025120149
#VU113355 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-54385
CWE-89 Low
No
No
16.10.6, 17.3.0 rc-1 28.07.2025 SB2025072846
#VU113222 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32429
CWE-89 High
Available
No
16.10.6, 17.3.0 rc-1 25.07.2025 SB2025072519
#VU108077 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2025-32970
CWE-601 Medium
No
No
15.10.13, 16.4.4, 16.8.0 30.04.2025 SB2025043015
#VU108076 - Improper Authorization
CVE-2025-32972
CWE-285 Medium
No
No
15.10.12, 16.4.3, 16.8.0 30.04.2025 SB2025043020
#VU108072 - Improper Access Control
CVE-2025-32973
CWE-284 Medium
No
No
15.10.12, 16.4.3, 16.8.0 30.04.2025 SB2025043019
#VU108070 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-32974
CWE-79 Low
No
No
15.10.8, 16.2.0 30.04.2025 SB2025043018
#VU108069 - Missing Authorization
CVE-2025-46557
CWE-862 High
No
No
15.10.14, 16.4.6, 16.10.0 rc-1 30.04.2025 SB2025043017
#VU108068 - Missing Authorization
CVE-2025-46554
CWE-862 Medium
No
No
14.10.22, 15.10.12, 16.4.3, 16.7.0 30.04.2025 SB2025043016
#VU125588 - Missing Authorization
CVE-2025-23025
CWE-862 Medium
No
No
15.10.12, 16.4.1 14.01.2025 SB2025022402
SB2025043016
#VU125593 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-41947
CWE-80 Medium
No
No
15.10.8 31.07.2024 SB2025043018


Showing elements 21 - 40 out of 232