Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xwiki | xwiki-platform | >= 9.4-rc-1, < 16.10.6, >= 17.0.0-rc-1, < 17.3.0-rc-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- XWiki 14 - SQL Injection via getdeleteddocuments.vm EDB-52384 · webapps · Jul 28, 2025
GitHub 3 repositories
-
byteReaper77/CVE-2025-32429 ★ 10 · Jul 25, 2025
Exploit for CVE-2025-32429 – SQLi in XWiki REST API (getdeleteddocuments.vm).
-
imbas007/CVE-2025-32429-Checker ★ 0 · Jul 28, 2025
-
amir-othman/CVE-2025-32429 ★ 0 · Jul 26, 2025
Proof-of-Concept exploit for CVE-2025-32429 (SQL Injection in PHP PDO prepared statements) – for educational and security research purposes only
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- XWiki Platform - SQL Injection http/cves/2025/CVE-2025-32429.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-distribution-war | >= 9.4-rc-1, < 16.10.6 | 16.10.6 | GHSA-vr59-gm53-v7cq |
| Maven | org.xwiki.platform:xwiki-platform-distribution-war | >= 17.0.0-rc-1, < 17.3.0-rc-1 | 17.3.0-rc-1 | GHSA-vr59-gm53-v7cq |
Advisories 1
- WID-SEC-2025-1643 xwiki: Mehrere Schwachstelle ermöglicht eine SQL Injection BSI CERT-Bund (WID) · Jul 28, 2025