Security
فارسی
All products

org.xwiki.platform:xwiki-platform-oldcore

Maven · Package
46 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
XWiki Platform allows remote code execution from user accountCVE-2024-37899 · GHSA-J584-J2VJ-3F93 org.xwiki.platform:xwiki-platform-oldcore Maven Critical Fix reported
XWiki Platform remote code execution from account via custom skins supportCVE-2024-31987 · GHSA-CV55-V6RW-7R5V org.xwiki.platform:xwiki-platform-oldcore Maven Critical Fix reported
XWiki Platform vulnerable to reflected cross-site scripting via delattachment actionCVE-2023-35157 · GHSA-PHWM-87RG-27QQ org.xwiki.platform:xwiki-platform-oldcore Maven High Fix reported
XWiki has no right protection on rollback actionCVE-2024-21648 · GHSA-XH35-W7WG-95V3 org.xwiki.platform:xwiki-platform-oldcoreorg.xwiki.platform:xwiki-platform Maven High Fix reported
XWiki Platform vulnerable to code injection in display method used in user profilesCVE-2023-29523 · GHSA-X764-FF8R-9HPX org.xwiki.platform:xwiki-platform-oldcore Maven Critical Fix reported
XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deletedCVE-2024-31464 · GHSA-V782-XR4W-3VQX org.xwiki.platform:xwiki-platform-oldcore Maven Medium Fix reported
XWiki Platform: Privilege escalation (PR) from user registration through PDFClassCVE-2024-31981 · GHSA-VXWR-WPJV-QJQ7 org.xwiki.platform:xwiki-platform-oldcore Maven Critical Fix reported
Velocity execution without script right through VelocityCode and VelocityWiki propertyCVE-2023-41046 · GHSA-M5M2-H6H9-P2C8 org.xwiki.platform:xwiki-platform-oldcore Maven Medium Fix reported
XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create actionCVE-2023-40572 · GHSA-4F8M-7H83-9F6M org.xwiki.platform:xwiki-platform-oldcore Maven High Fix reported
org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerabilityCVE-2023-32068 · GHSA-6GVJ-8VC5-8V3J org.xwiki.platform:xwiki-platform-oldcore Maven Medium Fix reported
org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents CVE-2023-29208 · GHSA-4F8G-FQ6X-JQRR org.xwiki.platform:xwiki-platform-oldcore Maven High Fix reported
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorCVE-2023-26474 · GHSA-3738-P9X3-MV9R org.xwiki.platform:xwiki-platform-legacy-oldcoreorg.xwiki.platform:xwiki-platform-oldcore Maven Critical Fix reported
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthorsCVE-2023-29507 · GHSA-PWFV-3CVG-9M4C org.xwiki.platform:xwiki-platform-oldcore Maven Critical Fix reported
XSS Cross Site ScriptingCVE-2021-29459 · GHSA-5C66-V29H-XJH8 org.xwiki.platform:xwiki-platform-oldcoreorg.xwiki.platform:xwiki-platform-web Maven Critical Fix reported
RCE in XWikiCVE-2020-15252 · GHSA-5HV6-MH8Q-Q9V8 org.xwiki.platform:xwiki-platform-oldcore Maven High Fix reported
Cross-site Scripting by SVG upload in xwiki-platformCVE-2021-43841 · GHSA-9JQ9-C2CV-PCRJ org.xwiki.platform:xwiki-platform-oldcoreorg.xwiki.platform:xwiki-platform-tool-configuration-resources Maven Medium Fix reported
Users with SCRIPT right can execute arbitrary code in XWikiCVE-2020-15171 · GHSA-7QW5-PQHC-XM4G org.xwiki.platform:xwiki-platform-oldcore Maven Low Fix reported
XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+CVE-2026-34151 · GHSA-QJ4X-9G63-25G6 org.xwiki.platform:xwiki-platform-oldcore Maven High Fix reported
XWiki's REST APIs can list all pages/spaces, leading to unavailabilityCVE-2026-40104 · GHSA-MRQG-XMGM-RC5G org.xwiki.platform:xwiki-platform-legacy-oldcoreorg.xwiki.platform:xwiki-platform-oldcore Maven Medium Fix reported
XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting APICVE-2026-33229 · GHSA-H259-74H5-4RH9 org.xwiki.platform:xwiki-platform-legacy-oldcoreorg.xwiki.platform:xwiki-platform-oldcore Maven High Fix reported