Exposición de XWiki

Wikis
328
score de exposición
37
sitios usan
1
en explotación
121
críticos
Análisis Vexday

Com 245 CVEs catalogadas, o XWiki apresenta um volume expressivo de vulnerabilidades, sendo 121 delas de severidade crítica — número que por si só justifica atenção redobrada em ambientes que utilizam a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que, em wikis colaborativos com renderização de conteúdo rico, tende a ter superfície de ataque ampla e impacto relevante sobre usuários autenticados. A CVE mais perigosa atualmente ativa é CVE-2025-24893, com score EPSS de 0,999 — valor que indica probabilidade extremamente alta de exploração ativa —, exigindo priorização imediata de remediação. A taxa de exploração confirmada no CISA KEV está em linha com a média geral do catálogo, mas o EPSS elevado dessa CVE sugere que a exposição real pode ser significativamente maior do que o número de entradas KEV indica.

CVEs

245 resultados
CVE-2023-35160CRITICALXWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit templateEPSS 2.3%CVE-2025-52472CRITICALXWiki Platform vulnerable to HQL injection via wiki and space search REST APIEPSS 2.2%CVE-2023-46732CRITICALReflected Cross-site scripting through revision parameter in content menu in XWiki PlatformEPSS 2.2%CVE-2023-35159CRITICALXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace templateEPSS 2.2%CVE-2020-11057CRITICALCode Injection in XWiki PlatformEPSS 2.2%CVE-2024-31996CRITICALXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionEPSS 2.1%CVE-2021-32621HIGHScript injection without script or programming rights through Gadget titlesEPSS 2.1%CVE-2022-23616HIGHRemote code execution in xwiki-platformEPSS 2.1%CVE-2023-35156CRITICALXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete templateEPSS 2.1%CVE-2023-35158CRITICALXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore templateEPSS 2.0%CVE-2023-29523CRITICALCode injection in display method used in user profiles in xwiki-platformEPSS 2.0%CVE-2023-29519CRITICALCode injection in org.xwiki.platform:xwiki-platform-attachment-uiEPSS 1.9%CVE-2023-36470CRITICALCode injection in icon themes of XWiki PlatformEPSS 1.9%CVE-2023-29514CRITICALCode injection in template provider administration in xwiki-platformEPSS 1.9%CVE-2023-29510CRITICALCode injection via unescaped translations in xwiki-platformEPSS 1.9%CVE-2023-29522CRITICALCode injection from view right on XWiki.ClassSheet in xwiki-platformEPSS 1.9%CVE-2023-36468CRITICALUpgrading doesn't prevent exploiting vulnerable XWiki documentsEPSS 1.8%CVE-2023-45134CRITICALXWiki Platform XSS vulnerability from account in the create page form via template providerEPSS 1.8%CVE-2025-55748CRITICALXWiki Platform's configuration files can be accessed through jsx and sx endpointsEPSS 1.8%CVE-2023-29204MEDIUMURL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcoreEPSS 1.8%