GHSA-G9JJ-75MX-WJCX org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

🗓️ 23 Apr 2025 14:41:54Reported by GoogleType

osv

osv🔗 osv.dev👁 15 Views

XWiki platform vulnerability allows SQL injection via script query API, exposing user data risks.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, relates to the lack of measures taken to protect the SQL query structure, allowing attackers to gain access to protected information.	20 Oct 202500:00	–	bdu_fstec
Circl	CVE-2025-32968	23 Apr 202517:19	–	circl
CNNVD	XWiki Platform SQL注入漏洞	23 Apr 202500:00	–	cnnvd
CVE	CVE-2025-32968	23 Apr 202515:27	–	cve
Cvelist	CVE-2025-32968 org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API	23 Apr 202515:27	–	cvelist
EUVD	EUVD-2025-12169	3 Oct 202520:07	–	euvd
Github Security Blog	org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API	23 Apr 202514:41	–	github
NVD	CVE-2025-32968	23 Apr 202516:15	–	nvd
OpenVAS	XWiki 1.6 < 15.10.16, 16.0.0 < 16.4.6, 16.5.0 < 16.10.1 SQLi Vulnerability (GHSA-g9jj-75mx-wjcx)	23 Apr 202500:00	–	openvas
OSV	CVE-2025-32968 org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API	23 Apr 202515:27	–	osv

Source	Link
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-g9jj-75mx-wjcx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-32968
github	www.github.com/xwiki/xwiki-platform
jira	www.jira.xwiki.org/browse/XWIKI-22718

23 Apr 2025 19:15Current

7.5High risk

Vulners AI Score7.5

CVSS 48.6

EPSS0.00484

sql injection xwiki platform security vulnerability user rights database exposure patch versions workarounds.