xwikisas vulnerabilities

Products

• xwiki-pro-macros 8
• macro pdfviewer 4
• macro-pdfviewer 4
• application-confluence-migrator-pro 2
• application licensing 1
• application-admintools 1
• application-collabora 1
• application-licensing 1
• application-urlshortener 1
• identity-oauth 1

Latest xwikisas CVEs

Newest publication first

1. CVE-2026-44179 XWiki Pro Macros: excerpt-include title and content injection executes code

   Published 2026-10-28

   Critical·CVSS 9.9 EPSS 0.69%

   XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handlin...

2. CVE-2025-65036 XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

   Published 2025-12-05

   High·CVSS 8.3 EPSS 0.43%

   XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed i...

3. CVE-2025-65089 XWiki view file macro: User can view content of office file without view rights on the attachment

   Published 2025-11-19

   Medium·CVSS 6.5 EPSS 0.30%

   XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in...

4. CVE-2025-54990 XWiki AdminTools application doesn't set permissions on the AdminTools space

   Published 2025-11-18

   Medium·CVSS 5.3 EPSS 0.25%

   XWiki AdminTools integrates administrative tools for managing a running XWiki instance. Prior to version 1.1, users without admin rights have access to AdminTools.SpammedPages. View rights are not restricted only to admin users for AdminTools.SpammedPages. While no data is visibl...

5. CVE-2025-55730 XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro

   Published 2025-09-09

   Critical·CVSS 10.0 EPSS 0.74%

   XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the title in the confluence paste code macro allows remote code execution for any user who can edit...

6. CVE-2025-55729 XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro

   Published 2025-09-09

   Critical·CVSS 10.0 EPSS 0.74%

   XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the ac:type in the ConfluenceLayoutSection macro allows remote code execution for any user who can...

7. CVE-2025-55728 XWiki Remote Macros vulnerable to remote code execution using the panel macro

   Published 2025-09-09

   Critical·CVSS 9.8 EPSS 0.80%

   XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any...

8. CVE-2025-55727 XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro

   Published 2025-09-09

   Critical·CVSS 9.8 EPSS 1.1%

   XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any user who can edit any...

9. CVE-2025-48885 application-urlshortener users can create arbitrary pages as long as they have view access to them

   Published 2025-05-30

   Medium·CVSS 5.7 EPSS 0.22%

   application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user (even guests) can create these docs, even if they don't exist already. This can enable guest users to de...

10. CVE-2025-27604 XWiki Confluence Migrator Pro's homepage is public

    Published 2025-03-07

    High·CVSS 7.5 EPSS 0.38%

    XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.

11. CVE-2025-27603 XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations

    Published 2025-03-07

    Critical·CVSS 9.1 EPSS 0.66%

    XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is...

12. CVE-2024-52298 macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

    Published 2024-11-13

    High·CVSS 7.5 EPSS 0.67%

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the at...

13. CVE-2024-52299 The PDF viewer macro allows accessing any attachment without access right checks

    Published 2024-11-13

    High·CVSS 7.5 EPSS 0.52%

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't upd...

14. CVE-2024-52300 macro-pdfviewer has a XSS through the width parameter

    Published 2024-11-13

    Critical·CVSS 9.0 EPSS 0.46%

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation...

15. CVE-2024-42489 Pro Macros Remote Code Execution via Viewpdf and similar macros

    Published 2024-08-12

    High·CVSS 8.8 EPSS 1.1%

    Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the CKEditor.HTMLConverter page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of...

16. CVE-2024-30263 The PDF Viewer macro can be used to view PDF attachments with restricted access

    Published 2024-04-04

    High·CVSS 7.7 EPSS 0.55%

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the file parameter. Users with view rights can access restricted PDF a...

17. CVE-2024-26138 License information is public, exposing instance id and license holder details

    Published 2024-02-21

    Medium·CVSS 5.3 EPSS 0.49%

    The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document Licenses.Code.LicenseJSON that provides information for admins regarding active licenses. This document is public and thus exposes this information publicly....

18. CVE-2023-46743 The same file cannot be opened with different rights

    Published 2023-11-09

    Medium·CVSS 4.3 EPSS 0.62%

    application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attach...

19. CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

    Published 2023-10-16

    Critical·CVSS 9.6 EPSS 1.2%

    com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.