Skip to content
OpenAdvisories
High WID-SEC-2025-1643 2 CVEs

xwiki: Mehrere Schwachstelle ermöglicht eine SQL Injection

Published Jul 24, 2025 · Updated Jul 28, 2025 · Revision 3 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann Schwachstellen in xwiki ausnutzen, um eine SQL Injection durchzuführen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 2

  • Critical 9.3
    CVE-2025-32429 Public exploit Scanner template EPSS 85%

    XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocu…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-distribution-war Maven
  • High 8.6
    CVE-2025-54385

    XWiki Platform's searchDocuments API allows for SQL injection

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMS_…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven

Revision history

  1. #3

    PoC aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-22764

  3. #1

    Initiale Fassung

References