CVE-2025-24893-EXP

CVE-2025-24893-EXP Affected Versions xwiki-platform = 5.3-milestone-2, = 16.0.0-rc-1, 16.4.1 16.0.0-rc-1, 16.4.1 POC https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24893.yaml CVE-2025-24893 - XWiki Platform Exploit usage: python CVE-2025-24893.py -u -c...

CVE-2025-24893

Exploit for CVE-2025-24893 CVE-2025-24893 is a critical unauthenticated remote code execution RCE vulnerability affecting the XWiki Platform. This flaw lets any guest user inject and execute arbitrary Groovy code —without authentication—via a specially crafted RSS request to the SolrSearch...

codeql-workshop-cve-2021-21380

CodeQL workshop for Java: Finding a SQL injection In this workshop we will use syntactical and semantic reasoning to find a SQL injection in the XWiki platform's rating component documented by CVE-2021-21380 Contents CodeQL workshop for Java: Finding a SQL injection Contents Prerequisites and set...

CVE-2025-24893

CVE-2025-24893 PoC | XWiki Platform 15.10.10 - Remote Code Execution An RCE Remote Code Execution category vulnerability, found when unauthenticated attackers can execute arbitrary Groovy code remotely without authentication or prior access Guest User. Below is a PoC Proof-Of-Concept in Python fo...

CVE-2024-31982

CVE-2024-31982 PoC and Bulk Scanner Overview POC for CVE-2024-31982: XWiki Platform Remote Code Execution 14.10.20. This POC is based on this security advisory . How to Use Single Target Scan To scan a single target endpoint: python CVE-2024-31982.py -u target Bulk Target Scan To mass scan bulk...

CVE-2025-24893

CVE-2025-24893 XWiki Platform is a generic wiki platform that provides runtime services for applications built on top of it. Due to a vulnerability in the SolrSearch endpoint, an unauthenticated user can achieve arbitrary remote code execution. This vulnerability affects the confidentiality,...

XWiki Platform - Path Traversal

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

XWiki - Information Disclosure

XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package. id: CVE-2025-55749 info: name:...

XWiki Platform - Cross-Site Scripting

XWiki Platform versions = 4.2-milestone-3 and = 16.5.0-rc-1 and = 17.0.0-rc-1 and = 4.2-milestone-3 and = 16.5.0-rc-1 and = 17.0.0-rc-1 and 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the...

XWiki < 4.10.20 - Remote code execution

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a close...

XWiki Platform - Path Traversal

XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges. id: CVE-2025-55748 info: name: XWiki Platform - Path Traversal author:...

XWiki Platform - Password Hash Disclosure

XWiki Platform is a generic wiki platform. The patch for GHSA-5cf8-vrr8-8hjm / CVE-2023-26476 was insufficient. Starting with version 6.2.1 and prior to 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1, slightly modified LiveTableResults parameters for example passwordclass still allow an unauthenticate...

XWiki Platform - Information Disclosure

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. id: CVE-2025-55747 info: name: XWiki Platform - Information Disclosure author: Redmomn...

XWiki >= 6.2-milestone-1 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

xwiki__xwiki-commons_CVE-2023-29201_14-5

XWiki Commons XWiki Commons are technical libraries common to several other top level XWiki projects. These libraries can be used by projects outside of the XWiki ecosystem, are generic and not related to the wiki domain. XWiki Platform, XWiki Commons and XWiki Rendering are part of the XWiki.org...

CVE-2020-13654

CVE-2020-13654 - XWiki Platform Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/xwiki-xss-cve-2020-13654/ NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2020-13654 Vulnerability XWiki Platform before version 12.8 does not apply HTML encoding to user-controlled fields ...

cve-2025-24893

CVE-2025-24893 XWiki RCE Exploit A simple Python3 script to exploit CVE-2025-24893 , a remote code execution vulnerability in XWiki Platform, using a Groovy-based async macro and a configurable reverse shell payload. ⚠️ WARNING: This tool is provided for educational and authorized testing purposes...

CVE-2025-24893-

CVE-2025-24893- CVE-2025-24893 | Remote Code Execution Vulnerability on XWiki platform proof of concept...

VulnCheck KEV: CVE-2026-34151

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

XWiki-Platform-RCE-CVE-2025-24893

XWiki Platform Unauthenticated RCE Exploit Overview This script is a refurbished Bash implementation of an exploit targeting the XWiki Platform versions affected by CVE-2025-24893. It leverages a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitra...