Sign in
Deutsch English Español Polski
Medium

XWiki Remote Code Execution

  • Disclosed: 01.05.2022
  • Updated: 11.10.2026 11:21

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-oldcore >= 0.9.543, < 1.0B1 1.0B1

References

CVSS score -
Weakness (CWE)
-
Platform
Java / Kotlin (Maven)
Package
org.xwiki.platform:xwiki-platform-oldcore
Disclosed
01.05.2022
Updated
11.10.2026 11:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-h5jm-jjgx-q2wf - CC BY 4.0

Vulnerability history: org.xwiki.platform:xwiki-platform-oldcore

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive
Total entries
46
First → latest
09.2020 07.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 12
  • High 17
  • Medium 15
  • Low 2

Disclosures per year

Severity:
  1. XWiki Remote Code Execution this entry
    Medium CVE-2006-7223 >= 0.9.543, < 1.0B1 1.0B1
  2. XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
    High CVE-2026-34151 < 17.10.5, >= 18.0.0-rc-1, < 18.2.0 17.10.5, 18.2.0
  3. XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
    High CVE-2026-33229 >= 17.0.0-rc-1, < 17.4.8, >= 17.5.0-rc-1, < 17.10.1 17.4.8, 17.10.1
  4. XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
    High CVE-2025-54125 >= 1.1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  5. XWiki leaks password hashes and other accessible password properties
    High CVE-2025-54124 >= 9.8-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  6. XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
    High CVE-2025-54385 >= 1.0, < 16.10.6, >= 17.0.0-rc1, < 17.3.0-rc-1 16.10.6, 17.3.0-rc-1
  7. XWiki allows remote code execution through preview of XClass changes in AWM editor
    High CVE-2025-49586 >= 7.2-milestone-2, < 16.4.7, >= 16.5.0-rc-1, < 16.10.3, >= 17.0.0-rc-1, < 17.0.0 16.4.7, 16.10.3, 17.0.0
  8. XWiki allows SQL injection in query endpoint of REST API with Oracle
    Critical CVE-2024-56158 >= 1.0, < 15.10.16, >= 16.0.0-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.2 15.10.16, 16.4.7, 16.10.2
  9. org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
    High CVE-2025-32968 >= 1.6-milestone-1, < 15.10.16, >= 16.0.0-rc-1, < 16.4.6, >= 16.5.0-rc-1, < 16.10.1 15.10.16, 16.4.6, 16.10.1
  10. XWiki Platform allows XSS through XClass name in string properties
    Critical · 9.0 CVE-2024-43400 >= 1.1.2, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  11. XWiki Platform allows remote code execution from user account
    Critical · 9.0 CVE-2024-37899 >= 13.4.7, < 14.10.21, >= 13.10.3, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  12. XWiki Platform remote code execution from account via custom skins support
    Critical · 9.9 CVE-2024-31987 >= 6.4-milestone-1, < 14.10.19, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.19, 15.5.4, 15.10-rc-1
  13. XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
    Critical · 9.9 CVE-2024-31981 >= 3.0.1, < 14.10.20, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.20, 15.5.4, 15.10-rc-1
  14. XWiki has no right protection on rollback action
    High · 8.0 CVE-2024-21648 >= 1.0, < 14.10.17 14.10.17
  15. XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
    High · 8.8 CVE-2023-46243 >= 15.0, < 15.2-rc-1, >= 1.0, < 14.10.6 15.2-rc-1, 14.10.6
  16. XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
    Critical · 9.6 CVE-2023-46242 >= 1.0, < 14.10.7, >= 15.0, < 15.2-rc-1 14.10.7, 15.2-rc-1
  17. XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
    High · 8.0 CVE-2023-40572 >= 3.2-milestone-3, < 14.10.9, >= 15.0-rc-1, < 15.4-rc-1 14.10.9, 15.4-rc-1
  18. Upgrading doesn't prevent exploiting vulnerable XWiki documents
    Critical · 9.9 CVE-2023-36468 >= 2.0, < 14.10.7, >= 15.0-rc-1, < 15.2-rc-1 14.10.7, 15.2-rc-1
  19. XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
    High · 8.4 CVE-2023-35157 >= 3.2-milestone-3, < 14.10.6, >= 15.0-rc-0, < 15.1-rc-1 14.10.6, 15.1-rc-1
  20. XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
    Critical · 9.9 CVE-2023-29526 >= 10.11.1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.3 13.10.11, 14.4.8, 14.10.3
  21. XWiki Platform vulnerable to code injection in display method used in user profiles
    Critical · 9.9 CVE-2023-29523 >= 3.3-milestone-1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.2 13.10.11, 14.4.8, 14.10.2
Show more (9) Showing 21 of 30

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.