Xwiki vendor intelligence
Xwiki Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Xwiki products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 4
- Known exploited vulnerabilities affecting Xwiki products
- In CISA KEV
- 1
- Records also listed in the official catalog
- Beyond CISA KEV
- 3
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 1
- Xwiki KEV with sensor-observed exploitation activity
The catalog gap matters for Xwiki exposure
Three of the four exploited Xwiki vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss three-quarters of this vendor portfolio.
- 25%
- Covered by CISA
- 75%
- Beyond CISA
- 1
- Product families
Attested Xwiki vulnerabilities
4 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2025-32969
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API |
xwiki-platform | High | Beyond CISA | 13 Sep 2026 |
|
CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch |
xwiki-platform | High | Beyond CISA | 10 Sep 2026 |
|
CVE-2023-37462
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui |
xwiki-platform | High | Beyond CISA | 08 Sep 2026 |
|
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki |
xwiki-platform | Confirmed | In CISA | 24 Apr 2025 |
No Xwiki vulnerabilities match this search or filter.
Showing 4 of 4 on this page (4 Xwiki known exploited vulnerabilities).
Recurring weakness patterns
Neutralization, neutralization, and neutralization account for five mapped occurrences across this Xwiki KEV portfolio.
CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')