Patchfirst: xwiki vulnerabilitieshttps://patchfirst.co/vendor/xwiki/New and newly exploited xwiki CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2025-55749: The XWiki Jetty package (XJetty) allows accessing any application file through URLhttps://patchfirst.co/cve/CVE-2025-55749/CVE-2025-55749Mon, 01 Dec 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 1.5% (higher than 73.8% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 65.8 of 100.public-exploit[KEV] CVE-2025-24893: XWiki Platform Eval Injection Vulnerabilityhttps://patchfirst.co/cve/CVE-2025-24893/CVE-2025-24893#kevThu, 30 Oct 2025 00:00:00 GMTXWiki · Platform. In CISA KEV since 2025-10-30. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059CVE-2025-52472: XWiki Platform vulnerable to HQL injection via wiki and space search REST APIhttps://patchfirst.co/cve/CVE-2025-52472/CVE-2025-52472Mon, 06 Oct 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 2.4% (higher than 83.8% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 68.3 of 100.public-exploitCVE-2025-55748: XWiki Platform's configuration files can be accessed through jsx and sx endpointshttps://patchfirst.co/cve/CVE-2025-55748/CVE-2025-55748Wed, 03 Sep 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 1.8% (higher than 78.1% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 67.1 of 100.public-exploitCVE-2025-55747: XWiki Platform's configuration files can be accessed through the webjars APIhttps://patchfirst.co/cve/CVE-2025-55747/CVE-2025-55747Wed, 03 Sep 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 1.7% (higher than 76.9% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 66.9 of 100.public-exploitCVE-2025-54125: XWiki Platform: Password and email exposure in xml.vm fieldshttps://patchfirst.co/cve/CVE-2025-54125/CVE-2025-54125Tue, 05 Aug 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 1.5% (higher than 73.4% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 60.8 of 100.public-exploitCVE-2025-32429: XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterhttps://patchfirst.co/cve/CVE-2025-32429/CVE-2025-32429Thu, 24 Jul 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 85.5% (higher than 99.72% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 71.5 of 100.public-exploitCVE-2025-46554: XWiki missing authorization when accessing the wiki level attachments list and metadata via REST APIhttps://patchfirst.co/cve/CVE-2025-46554/CVE-2025-46554Wed, 30 Apr 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 56.5 of 100.public-exploitCVE-2025-32970: org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerabilityhttps://patchfirst.co/cve/CVE-2025-32970/CVE-2025-32970Wed, 30 Apr 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 0.6% (higher than 48% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. Priority 53.9 of 100.public-exploitCVE-2025-32969: org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIhttps://patchfirst.co/cve/CVE-2025-32969/CVE-2025-32969Wed, 23 Apr 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 80.0% (higher than 99.61% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 66.4 of 100.public-exploitCVE-2025-29925: XWiki allows unregistered users to access private pages information through REST endpointhttps://patchfirst.co/cve/CVE-2025-29925/CVE-2025-29925Wed, 19 Mar 2025 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 0.9% (higher than 61.2% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 58.3 of 100.public-exploitCVE-2024-31982: XWiki Platform: Remote code execution as guest via DatabaseSearchhttps://patchfirst.co/cve/CVE-2024-31982/CVE-2024-31982Wed, 10 Apr 2024 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 34.5% (higher than 98.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 66.7 of 100.public-exploitCVE-2024-31997: XWiki Platform remote code execution from account through UIExtension parametershttps://patchfirst.co/cve/CVE-2024-31997/CVE-2024-31997Wed, 10 Apr 2024 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 73.9% (higher than 99.48% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2024-31984: XWiki Platform: Remote code execution through space title and Solr space facethttps://patchfirst.co/cve/CVE-2024-31984/CVE-2024-31984Wed, 10 Apr 2024 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 83.0% (higher than 99.67% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2024-31465: XWiki Platform: Remote code execution from account via SearchSuggestSourceSheethttps://patchfirst.co/cve/CVE-2024-31465/CVE-2024-31465Wed, 10 Apr 2024 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2024-21650: XWiki Remote Code Execution vulnerability via user registrationhttps://patchfirst.co/cve/CVE-2024-21650/CVE-2024-21650Mon, 08 Jan 2024 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 93.5% (higher than 99.84% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 67.0 of 100.public-exploitCVE-2023-50719: XWiki Platform Solr search discloses password hashes of all usershttps://patchfirst.co/cve/CVE-2023-50719/CVE-2023-50719Fri, 15 Dec 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 83.5% (higher than 99.69% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 30.2 of 100.public-exploitCVE-2023-50720: XWiki Platform Solr search discloses email addresses of usershttps://patchfirst.co/cve/CVE-2023-50720/CVE-2023-50720Fri, 15 Dec 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 59.1% (higher than 99.11% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 28.5 of 100.public-exploitCVE-2023-50721: XWiki Platform RCE from account through SearchAdminhttps://patchfirst.co/cve/CVE-2023-50721/CVE-2023-50721Fri, 15 Dec 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 78.8% (higher than 99.59% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2023-48241: XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest servicehttps://patchfirst.co/cve/CVE-2023-48241/CVE-2023-48241Mon, 20 Nov 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 72.8% (higher than 99.45% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 30.1 of 100.public-exploitCVE-2023-46732: Reflected Cross-site scripting through revision parameter in content menu in XWiki Platformhttps://patchfirst.co/cve/CVE-2023-46732/CVE-2023-46732Mon, 06 Nov 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 2.2% (higher than 82.4% of CVEs). CVSS 9.7 CRITICAL. Public exploit code exists. Priority 63.3 of 100.public-exploitCVE-2023-46731: Remote code execution through the section parameter in Administration as guest in XWiki Platformhttps://patchfirst.co/cve/CVE-2023-46731/CVE-2023-46731Mon, 06 Nov 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 88.5% (higher than 99.77% of CVEs). CVSS 10.0 CRITICAL. Priority 27.0 of 100.CVE-2023-40176: SXSS in the user profile via the timezone displayerhttps://patchfirst.co/cve/CVE-2023-40176/CVE-2023-40176Wed, 23 Aug 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 80.0% (higher than 99.61% of CVEs). CVSS 9.1 CRITICAL. Priority 26.3 of 100.CVE-2023-37462: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in…https://patchfirst.co/cve/CVE-2023-37462/CVE-2023-37462Fri, 14 Jul 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 91.6% (higher than 99.81% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 77.0 of 100.public-exploitCVE-2023-36469: Code injection through NotificationRSSService in XWiki Platformhttps://patchfirst.co/cve/CVE-2023-36469/CVE-2023-36469Thu, 29 Jun 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 82.0% (higher than 99.65% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2023-35150: XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationhttps://patchfirst.co/cve/CVE-2023-35150/CVE-2023-35150Fri, 23 Jun 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 77.7% (higher than 99.56% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.CVE-2023-35166: Privilege escalation (PR) from account through TipsPanelhttps://patchfirst.co/cve/CVE-2023-35166/CVE-2023-35166Tue, 20 Jun 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 62.2% (higher than 99.18% of CVEs). CVSS 10.0 CRITICAL. Priority 26.8 of 100.CVE-2023-32068: URL Redirection to Untrusted Site in XWikihttps://patchfirst.co/cve/CVE-2023-32068/CVE-2023-32068Mon, 15 May 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 55.1% (higher than 99.03% of CVEs). CVSS 4.7 MEDIUM. Public exploit code exists. Priority 28.1 of 100.public-exploitCVE-2023-32071: XWiki Platform vulnerable to RXSS via editor parameter - importinline templatehttps://patchfirst.co/cve/CVE-2023-32071/CVE-2023-32071Tue, 09 May 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 70.4% (higher than 99.39% of CVEs). CVSS 9.1 CRITICAL. Priority 26.2 of 100.CVE-2023-29524: Code injection from account through XWiki.SchedulerJobSheet in xwiki-platformhttps://patchfirst.co/cve/CVE-2023-29524/CVE-2023-29524Tue, 18 Apr 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 75.7% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2023-29525: Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platformhttps://patchfirst.co/cve/CVE-2023-29525/CVE-2023-29525Tue, 18 Apr 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 77.8% (higher than 99.57% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2023-29516: Code injection from view right on XWiki.AttachmentSelector in xwiki-platformhttps://patchfirst.co/cve/CVE-2023-29516/CVE-2023-29516Tue, 18 Apr 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 65.9% (higher than 99.27% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.CVE-2023-29509: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityhttps://patchfirst.co/cve/CVE-2023-29509/CVE-2023-29509Sun, 16 Apr 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 76.2% (higher than 99.53% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2023-26477: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityhttps://patchfirst.co/cve/CVE-2023-26477/CVE-2023-26477Thu, 02 Mar 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 74.8% (higher than 99.5% of CVEs). CVSS 10.0 CRITICAL. Priority 26.9 of 100.CVE-2023-26475: XWiki Platform vulnerable to Remote Code Execution in Annotationshttps://patchfirst.co/cve/CVE-2023-26475/CVE-2023-26475Thu, 02 Mar 2023 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 63.6% (higher than 99.21% of CVEs). CVSS 10.0 CRITICAL. Priority 26.8 of 100.CVE-2022-36100: XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injectionhttps://patchfirst.co/cve/CVE-2022-36100/CVE-2022-36100Thu, 08 Sep 2022 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 73.6% (higher than 99.47% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.CVE-2022-36099: XWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityhttps://patchfirst.co/cve/CVE-2022-36099/CVE-2022-36099Thu, 08 Sep 2022 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 9.9 CRITICAL. Priority 26.8 of 100.CVE-2022-36098: XWiki Platform Mentions UI vulnerable to Cross-site Scriptinghttps://patchfirst.co/cve/CVE-2022-36098/CVE-2022-36098Thu, 08 Sep 2022 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 71.6% (higher than 99.42% of CVEs). CVSS 8.9 HIGH. Priority 26.1 of 100.CVE-2022-36096: XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listhttps://patchfirst.co/cve/CVE-2022-36096/CVE-2022-36096Thu, 08 Sep 2022 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 60.2% (higher than 99.14% of CVEs). CVSS 8.9 HIGH. Priority 26.1 of 100.CVE-2022-36094: XWiki Platform Web Parent POM vulnerable to XSS in the attachment historyhttps://patchfirst.co/cve/CVE-2022-36094/CVE-2022-36094Thu, 08 Sep 2022 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 64.8% (higher than 99.24% of CVEs). CVSS 8.9 HIGH. Priority 26.1 of 100.CVE-2022-36097: XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formhttps://patchfirst.co/cve/CVE-2022-36097/CVE-2022-36097Thu, 08 Sep 2022 00:00:00 GMTxwiki · xwiki-platform. Not in CISA KEV. EPSS 58.2% (higher than 99.09% of CVEs). CVSS 8.9 HIGH. Priority 26.0 of 100.