{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: xwiki vulnerabilities","home_page_url":"https://patchfirst.co/vendor/xwiki/","feed_url":"https://patchfirst.co/feed/vendor/xwiki.json","description":"New and newly exploited xwiki CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-55749","url":"https://patchfirst.co/cve/CVE-2025-55749/","title":"CVE-2025-55749: The XWiki Jetty package (XJetty) allows accessing any application file through URL","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 1.5% (higher than 73.8% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 65.8 of 100.","summary":"The XWiki Jetty package (XJetty) allows accessing any application file through URL","date_published":"2025-12-01T00:00:00.000Z","date_modified":"2025-12-01T20:34:50.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65.8,"kev":null,"epss":{"score":0.01471,"percentile":0.7375},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-24893#kev","url":"https://patchfirst.co/cve/CVE-2025-24893/","title":"[KEV] CVE-2025-24893: XWiki Platform Eval Injection Vulnerability","content_text":"XWiki · Platform. In CISA KEV since 2025-10-30. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"XWiki Platform Eval Injection Vulnerability","date_published":"2025-10-30T00:00:00.000Z","date_modified":"2026-06-17T08:59:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2025-10-30","ransomware":false},"epss":{"score":0.99974,"percentile":0.99978},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"XWiki","product":"Platform","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-52472","url":"https://patchfirst.co/cve/CVE-2025-52472/","title":"CVE-2025-52472: XWiki Platform vulnerable to HQL injection via wiki and space search REST API","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 2.4% (higher than 83.8% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 68.3 of 100.","summary":"XWiki Platform vulnerable to HQL injection via wiki and space search REST API","date_published":"2025-10-06T00:00:00.000Z","date_modified":"2025-10-06T15:13:42.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":68.3,"kev":null,"epss":{"score":0.02365,"percentile":0.83784},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-55748","url":"https://patchfirst.co/cve/CVE-2025-55748/","title":"CVE-2025-55748: XWiki Platform's configuration files can be accessed through jsx and sx endpoints","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 1.8% (higher than 78.1% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 67.1 of 100.","summary":"XWiki Platform's configuration files can be accessed through jsx and sx endpoints","date_published":"2025-09-03T00:00:00.000Z","date_modified":"2025-09-03T20:47:51.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.1,"kev":null,"epss":{"score":0.01771,"percentile":0.7812},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-55747","url":"https://patchfirst.co/cve/CVE-2025-55747/","title":"CVE-2025-55747: XWiki Platform's configuration files can be accessed through the webjars API","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 1.7% (higher than 76.9% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 66.9 of 100.","summary":"XWiki Platform's configuration files can be accessed through the webjars API","date_published":"2025-09-03T00:00:00.000Z","date_modified":"2025-09-03T20:48:27.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.9,"kev":null,"epss":{"score":0.01682,"percentile":0.76939},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-54125","url":"https://patchfirst.co/cve/CVE-2025-54125/","title":"CVE-2025-54125: XWiki Platform: Password and email exposure in xml.vm fields","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 1.5% (higher than 73.4% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 60.8 of 100.","summary":"XWiki Platform: Password and email exposure in xml.vm fields","date_published":"2025-08-05T00:00:00.000Z","date_modified":"2025-08-06T20:29:03.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":60.8,"kev":null,"epss":{"score":0.01452,"percentile":0.73383},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-32429","url":"https://patchfirst.co/cve/CVE-2025-32429/","title":"CVE-2025-32429: XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 85.5% (higher than 99.72% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 71.5 of 100.","summary":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","date_published":"2025-07-24T00:00:00.000Z","date_modified":"2025-07-25T13:32:47.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":71.5,"kev":null,"epss":{"score":0.85496,"percentile":0.99722},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-46554","url":"https://patchfirst.co/cve/CVE-2025-46554/","title":"CVE-2025-46554: XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 56.5 of 100.","summary":"XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API","date_published":"2025-04-30T00:00:00.000Z","date_modified":"2025-04-30T18:59:16.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":56.5,"kev":null,"epss":{"score":0.01048,"percentile":0.64197},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-32970","url":"https://patchfirst.co/cve/CVE-2025-32970/","title":"CVE-2025-32970: org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 0.6% (higher than 48% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. Priority 53.9 of 100.","summary":"org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability","date_published":"2025-04-30T00:00:00.000Z","date_modified":"2025-04-30T15:19:11.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":53.9,"kev":null,"epss":{"score":0.00585,"percentile":0.47962},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-32969","url":"https://patchfirst.co/cve/CVE-2025-32969/","title":"CVE-2025-32969: org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 80.0% (higher than 99.61% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 66.4 of 100.","summary":"org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API","date_published":"2025-04-23T00:00:00.000Z","date_modified":"2025-04-23T16:15:40.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.4,"kev":null,"epss":{"score":0.80009,"percentile":0.99614},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-29925","url":"https://patchfirst.co/cve/CVE-2025-29925/","title":"CVE-2025-29925: XWiki allows unregistered users to access private pages information through REST endpoint","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 0.9% (higher than 61.2% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 58.3 of 100.","summary":"XWiki allows unregistered users to access private pages information through REST endpoint","date_published":"2025-03-19T00:00:00.000Z","date_modified":"2025-03-19T19:25:43.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":58.3,"kev":null,"epss":{"score":0.0095,"percentile":0.61226},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-31982","url":"https://patchfirst.co/cve/CVE-2024-31982/","title":"CVE-2024-31982: XWiki Platform: Remote code execution as guest via DatabaseSearch","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 34.5% (higher than 98.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 66.7 of 100.","summary":"XWiki Platform: Remote code execution as guest via DatabaseSearch","date_published":"2024-04-10T00:00:00.000Z","date_modified":"2025-09-25T16:39:01.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.7,"kev":null,"epss":{"score":0.3452,"percentile":0.98414},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-31997","url":"https://patchfirst.co/cve/CVE-2024-31997/","title":"CVE-2024-31997: XWiki Platform remote code execution from account through UIExtension parameters","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 73.9% (higher than 99.48% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"XWiki Platform remote code execution from account through UIExtension parameters","date_published":"2024-04-10T00:00:00.000Z","date_modified":"2024-08-13T13:49:14.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.73925,"percentile":0.99478},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-31984","url":"https://patchfirst.co/cve/CVE-2024-31984/","title":"CVE-2024-31984: XWiki Platform: Remote code execution through space title and Solr space facet","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 83.0% (higher than 99.67% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"XWiki Platform: Remote code execution through space title and Solr space facet","date_published":"2024-04-10T00:00:00.000Z","date_modified":"2024-08-13T13:37:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.82996,"percentile":0.99673},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-31465","url":"https://patchfirst.co/cve/CVE-2024-31465/","title":"CVE-2024-31465: XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet","date_published":"2024-04-10T00:00:00.000Z","date_modified":"2024-08-13T13:56:21.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.75575,"percentile":0.99518},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-21650","url":"https://patchfirst.co/cve/CVE-2024-21650/","title":"CVE-2024-21650: XWiki Remote Code Execution vulnerability via user registration","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 93.5% (higher than 99.84% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 67.0 of 100.","summary":"XWiki Remote Code Execution vulnerability via user registration","date_published":"2024-01-08T00:00:00.000Z","date_modified":"2025-06-17T20:39:15.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67,"kev":null,"epss":{"score":0.9348,"percentile":0.99839},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-50719","url":"https://patchfirst.co/cve/CVE-2023-50719/","title":"CVE-2023-50719: XWiki Platform Solr search discloses password hashes of all users","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 83.5% (higher than 99.69% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 30.2 of 100.","summary":"XWiki Platform Solr search discloses password hashes of all users","date_published":"2023-12-15T00:00:00.000Z","date_modified":"2024-10-08T14:15:20.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":30.2,"kev":null,"epss":{"score":0.83548,"percentile":0.99686},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-50720","url":"https://patchfirst.co/cve/CVE-2023-50720/","title":"CVE-2023-50720: XWiki Platform Solr search discloses email addresses of users","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 59.1% (higher than 99.11% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 28.5 of 100.","summary":"XWiki Platform Solr search discloses email addresses of users","date_published":"2023-12-15T00:00:00.000Z","date_modified":"2024-08-02T22:16:47.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":28.5,"kev":null,"epss":{"score":0.59119,"percentile":0.99112},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-50721","url":"https://patchfirst.co/cve/CVE-2023-50721/","title":"CVE-2023-50721: XWiki Platform RCE from account through SearchAdmin","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 78.8% (higher than 99.59% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"XWiki Platform RCE from account through SearchAdmin","date_published":"2023-12-15T00:00:00.000Z","date_modified":"2024-08-02T22:16:47.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.78812,"percentile":0.9959},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-48241","url":"https://patchfirst.co/cve/CVE-2023-48241/","title":"CVE-2023-48241: XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 72.8% (higher than 99.45% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 30.1 of 100.","summary":"XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service","date_published":"2023-11-20T00:00:00.000Z","date_modified":"2024-08-02T21:23:39.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":30.1,"kev":null,"epss":{"score":0.7282,"percentile":0.99448},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-46732","url":"https://patchfirst.co/cve/CVE-2023-46732/","title":"CVE-2023-46732: Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 2.2% (higher than 82.4% of CVEs). CVSS 9.7 CRITICAL. Public exploit code exists. Priority 63.3 of 100.","summary":"Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform","date_published":"2023-11-06T00:00:00.000Z","date_modified":"2024-09-05T13:31:18.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.3,"kev":null,"epss":{"score":0.02191,"percentile":0.8242},"cvss":{"score":9.7,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-46731","url":"https://patchfirst.co/cve/CVE-2023-46731/","title":"CVE-2023-46731: Remote code execution through the section parameter in Administration as guest in XWiki Platform","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 88.5% (higher than 99.77% of CVEs). CVSS 10.0 CRITICAL. Priority 27.0 of 100.","summary":"Remote code execution through the section parameter in Administration as guest in XWiki Platform","date_published":"2023-11-06T00:00:00.000Z","date_modified":"2024-09-05T14:34:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27,"kev":null,"epss":{"score":0.88534,"percentile":0.99772},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-40176","url":"https://patchfirst.co/cve/CVE-2023-40176/","title":"CVE-2023-40176: SXSS in the user profile via the timezone displayer","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 80.0% (higher than 99.61% of CVEs). CVSS 9.1 CRITICAL. Priority 26.3 of 100.","summary":"SXSS in the user profile via the timezone displayer","date_published":"2023-08-23T00:00:00.000Z","date_modified":"2024-10-02T20:42:19.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.3,"kev":null,"epss":{"score":0.79989,"percentile":0.99613},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-37462","url":"https://patchfirst.co/cve/CVE-2023-37462/","title":"CVE-2023-37462: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in…","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 91.6% (higher than 99.81% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 77.0 of 100.","summary":"Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in…","date_published":"2023-07-14T00:00:00.000Z","date_modified":"2024-10-30T18:31:34.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":77,"kev":null,"epss":{"score":0.91592,"percentile":0.99812},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-36469","url":"https://patchfirst.co/cve/CVE-2023-36469/","title":"CVE-2023-36469: Code injection through NotificationRSSService in XWiki Platform","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 82.0% (higher than 99.65% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"Code injection through NotificationRSSService in XWiki Platform","date_published":"2023-06-29T00:00:00.000Z","date_modified":"2024-11-26T19:14:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.82032,"percentile":0.99652},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-35150","url":"https://patchfirst.co/cve/CVE-2023-35150/","title":"CVE-2023-35150: XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 77.7% (higher than 99.56% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.","summary":"XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application","date_published":"2023-06-23T00:00:00.000Z","date_modified":"2024-11-29T14:35:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.8,"kev":null,"epss":{"score":0.77654,"percentile":0.99563},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-35166","url":"https://patchfirst.co/cve/CVE-2023-35166/","title":"CVE-2023-35166: Privilege escalation (PR) from account through TipsPanel","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 62.2% (higher than 99.18% of CVEs). CVSS 10.0 CRITICAL. Priority 26.8 of 100.","summary":"Privilege escalation (PR) from account through TipsPanel","date_published":"2023-06-20T00:00:00.000Z","date_modified":"2024-12-06T21:35:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.8,"kev":null,"epss":{"score":0.62172,"percentile":0.99179},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-32068","url":"https://patchfirst.co/cve/CVE-2023-32068/","title":"CVE-2023-32068: URL Redirection to Untrusted Site in XWiki","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 55.1% (higher than 99.03% of CVEs). CVSS 4.7 MEDIUM. Public exploit code exists. Priority 28.1 of 100.","summary":"URL Redirection to Untrusted Site in XWiki","date_published":"2023-05-15T00:00:00.000Z","date_modified":"2025-01-22T21:37:24.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":28.1,"kev":null,"epss":{"score":0.5507,"percentile":0.99026},"cvss":{"score":4.7,"severity":"MEDIUM","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-32071","url":"https://patchfirst.co/cve/CVE-2023-32071/","title":"CVE-2023-32071: XWiki Platform vulnerable to RXSS via editor parameter - importinline template","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 70.4% (higher than 99.39% of CVEs). CVSS 9.1 CRITICAL. Priority 26.2 of 100.","summary":"XWiki Platform vulnerable to RXSS via editor parameter - importinline template","date_published":"2023-05-09T00:00:00.000Z","date_modified":"2025-01-28T16:36:40.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.2,"kev":null,"epss":{"score":0.70386,"percentile":0.99386},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-29524","url":"https://patchfirst.co/cve/CVE-2023-29524/","title":"CVE-2023-29524: Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 75.7% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform","date_published":"2023-04-18T00:00:00.000Z","date_modified":"2025-02-05T18:49:14.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.75693,"percentile":0.99521},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-29525","url":"https://patchfirst.co/cve/CVE-2023-29525/","title":"CVE-2023-29525: Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 77.8% (higher than 99.57% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform","date_published":"2023-04-18T00:00:00.000Z","date_modified":"2025-02-05T19:04:44.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.77752,"percentile":0.99568},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-29516","url":"https://patchfirst.co/cve/CVE-2023-29516/","title":"CVE-2023-29516: Code injection from view right on XWiki.AttachmentSelector in xwiki-platform","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 65.9% (higher than 99.27% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.","summary":"Code injection from view right on XWiki.AttachmentSelector in xwiki-platform","date_published":"2023-04-18T00:00:00.000Z","date_modified":"2025-02-05T20:34:10.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.8,"kev":null,"epss":{"score":0.65869,"percentile":0.99269},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-29509","url":"https://patchfirst.co/cve/CVE-2023-29509/","title":"CVE-2023-29509: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 76.2% (higher than 99.53% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability","date_published":"2023-04-16T00:00:00.000Z","date_modified":"2025-02-06T17:05:13.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.76183,"percentile":0.99534},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-26477","url":"https://patchfirst.co/cve/CVE-2023-26477/","title":"CVE-2023-26477: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 74.8% (higher than 99.5% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.","summary":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability","date_published":"2023-03-02T00:00:00.000Z","date_modified":"2025-03-05T21:27:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.9,"kev":null,"epss":{"score":0.74757,"percentile":0.99503},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-26475","url":"https://patchfirst.co/cve/CVE-2023-26475/","title":"CVE-2023-26475: XWiki Platform vulnerable to Remote Code Execution in Annotations","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 63.6% (higher than 99.21% of CVEs). CVSS 10.0 CRITICAL. Priority 26.8 of 100.","summary":"XWiki Platform vulnerable to Remote Code Execution in Annotations","date_published":"2023-03-02T00:00:00.000Z","date_modified":"2025-03-05T21:23:14.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.8,"kev":null,"epss":{"score":0.63587,"percentile":0.99213},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36100","url":"https://patchfirst.co/cve/CVE-2022-36100/","title":"CVE-2022-36100: XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 73.6% (higher than 99.47% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.","summary":"XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2025-04-22T17:22:29.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.8,"kev":null,"epss":{"score":0.73608,"percentile":0.99469},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36099","url":"https://patchfirst.co/cve/CVE-2022-36099/","title":"CVE-2022-36099: XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.","summary":"XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2025-04-22T17:22:46.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.8,"kev":null,"epss":{"score":0.76348,"percentile":0.99538},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36098","url":"https://patchfirst.co/cve/CVE-2022-36098/","title":"CVE-2022-36098: XWiki Platform Mentions UI vulnerable to Cross-site Scripting","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 71.6% (higher than 99.42% of CVEs). CVSS 8.9 HIGH. Priority 26.1 of 100.","summary":"XWiki Platform Mentions UI vulnerable to Cross-site Scripting","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2025-04-22T17:22:36.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.1,"kev":null,"epss":{"score":0.71607,"percentile":0.99418},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36096","url":"https://patchfirst.co/cve/CVE-2022-36096/","title":"CVE-2022-36096: XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 60.2% (higher than 99.14% of CVEs). CVSS 8.9 HIGH. Priority 26.1 of 100.","summary":"XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2025-04-23T17:12:48.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.1,"kev":null,"epss":{"score":0.60225,"percentile":0.99136},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36094","url":"https://patchfirst.co/cve/CVE-2022-36094/","title":"CVE-2022-36094: XWiki Platform Web Parent POM vulnerable to XSS in the attachment history","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 64.8% (higher than 99.24% of CVEs). CVSS 8.9 HIGH. Priority 26.1 of 100.","summary":"XWiki Platform Web Parent POM vulnerable to XSS in the attachment history","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2025-04-22T17:23:01.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.1,"kev":null,"epss":{"score":0.64794,"percentile":0.99243},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36097","url":"https://patchfirst.co/cve/CVE-2022-36097/","title":"CVE-2022-36097: XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form","content_text":"xwiki · xwiki-platform. Not in CISA KEV. EPSS 58.2% (higher than 99.09% of CVEs). CVSS 8.9 HIGH. Priority 26.0 of 100.","summary":"XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2025-04-22T17:22:54.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26,"kev":null,"epss":{"score":0.58162,"percentile":0.99091},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"xwiki","product":"xwiki-platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}