Skip to content
OpenAdvisories
High WID-SEC-2025-0873 2 CVEs

xwiki: Mehrere Schwachstellen ermöglichen SQL-Injection

Published Apr 22, 2025 · Updated Apr 22, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um SQL-Injection Angriffe durchzuführen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 2

  • Critical 9.3
    CVE-2025-32969 Scanner template EPSS 80%

    org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

    XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL st…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-rest-server Maven
  • High 8.6
    CVE-2025-32968

    org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

    XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQ…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven

Revision history

  1. #1

    Initiale Fassung

References