GHSA-F69V-XRJ8-RHXF org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

Impact It is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Preven...

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

Impact It is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Preven...

GHSA-G9JJ-75MX-WJCX org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

Impact It is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. Depending on the used database backend, the attacker may be able to not only obtain confidential information...

org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

Impact It is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. Depending on the used database backend, the attacker may be able to not only obtain confidential information...

XWiki 5.0 < 16.8.0 Information Disclosure Vulnerability (GHSA-42fh-pvvh-999x)

Xwiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki Platform SQL注入漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A SQL injection vulnerability exists in XWiki Platform versions prior to 15.10.16, prior to 16.4.6, and prior to 16.10.1, which stems from a SCRIPT privileged user being able to escape the H...

XWiki 1.8 < 15.10.16, 16.0.0 < 16.4.6, 16.5.0 < 16.10.1 SQLi Vulnerability (GHSA-f69v-xrj8-rhxf)

Xwiki is prone to a SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

XWiki 1.6 < 15.10.16, 16.0.0 < 16.4.6, 16.5.0 < 16.10.1 SQLi Vulnerability (GHSA-g9jj-75mx-wjcx)

Xwiki is prone to a SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

PT-2025-17644 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.8 through 15.10.15 XWiki versions 16.4.0 through 16.4.5 XWiki versions 16.10.0 through 16.10.0 Description: XWiki is a generic wiki platform. In the affected versions, it is possible for a remote unauthenticated user to escap...

PT-2025-17643 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.6-milestone-1 through 15.10.16 XWiki versions prior to 16.4.6 XWiki versions prior to 16.10.1 Description: The issue allows a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection t...

XWiki Platform SQL注入漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. XWiki Platform suffers from a SQL injection vulnerability that originates from a remote unauthenticated user who can escape the HQL execution context and perform blind SQL injection, which...

CVE-2025-32783

XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vulnerability is that any message sent i...

CVE-2025-32783

XWiki Platform vulnerability CVE-2025-32783 affects versions 5.0–16.7.1 when Message Stream is enabled and the wiki is configured as closed (Prevent unregistered users to view pages). A message sent in a subwiki to "everyone" is exposed to the main wiki via the Dashboard, even if the subwiki is p...

CVE-2025-32783 XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki

XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vulnerability is that any message sent i...

CVE-2025-32783 XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki

XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vulnerability is that any message sent i...

CVE-2025-32783 XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki

XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vulnerability is that any message sent i...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions 5.0 through 16.7.1, which stems from a misconfiguration of the message flow and could lead to information disclosure...

PT-2025-30704

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2 Description XWiki Platform is a generic wiki platform. A SQL injection vulnerability exists in the getdeleteddocuments.vm template due to insufficient sanitization...

The vulnerability of the PDFClassHandler component of the XWiki Platform, a platform for creating collaborative web applications. The XWiki Platform allows attackers to enhance their privileges.

The vulnerability of the PDFClassHandler component in the XWiki platform for creating collaborative web applications stems from the lack of authentication procedures. Exploiting this vulnerability could allow attackers to increase their privileges remotely...

The vulnerability of the software interface of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability arises from the failure to implement measures to neutralize instructions in dynamically executed code, allowing attackers to execute arbitrary code.

The vulnerability of the software interface of the XWiki Platform for creating collaborative web applications lies in the failure to implement measures to neutralize instructions within the dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...