xwiki-cve-2025-24893-poc

XWiki RCE 漏洞利用 PoC CVE-2025-24893 概述 本仓库包含针对 XWiki 远程代码执行 RCE 漏洞（编号 CVE-2025-24893）的概念验证 PoC 漏洞利用代码。该漏洞允许攻击者通过向 SolrSearch 端点发送精心构造的请求，在目标 XWiki 实例上执行任意代码。本脚本同时支持 HTTP 和 HTTPS 目标。 ⚠️ 免责声明 ：本 PoC 仅供教育及研究用途。未经明确许可，将此代码用于任何系统均属违法且不道德。测试任何系统前，请务必获得适当授权。 漏洞详情 CVE 编号 ：CVE-2025-24893 受影响组件 ：XWiki...

CVE-2025-24893-XWiki-RCE

📜 描述 XWiki 中存在一个严重 RCE 漏洞 ，允许未经身份验证的攻击者 通过易受攻击的 API 端点执行任意系统命令。 利用该漏洞可能导致： 完全接管服务器 数据窃取或破坏 横向渗透内部网络 💥 影响 完全攻陷 受影响的 XWiki 实例及底层操作系统。 丧失机密性、完整性和可用性 。 🛠 修复 / 缓解措施 升级 到最新的修补版本（）。 限制 或禁用易受攻击的 API 端点。 应用 WAF 规则 阻止恶意载荷。 漏洞利用： SHODAN DORK : http.title:"XWiki" 使用方法： git clone...

CVE-2025-24893

CVE-2025-24893 root@kitploit: Exploit Title: XWiki 15.10.10 - Unauthenticated Remote Code Execution Date: 09/08/2025 Exploit Author: D3Ext Vendor Homepage: https://www.xwiki.org/ Software Link: https://github.com/xwiki/xwiki-platform Version: 15.10.10 Tested on: Kali Linux 2025 CVE: CVE-2025-2489...

CVE-2025-24893-PoC

CVE-2025-24893 – XWiki远程命令执行（概念验证） 概述 本仓库包含一个针对CVE-2025-24893 的受控概念验证（PoC） ，该漏洞是影响XWiki 的未认证远程命令执行（RCE）漏洞。 由于不安全的服务器端模板和脚本评估，该漏洞允许攻击者在服务器上执行任意操作系统命令。 关于 XWiki XWiki是一个开源的企业级维基平台，常用于： 内部文档 知识库 团队协作门户 由于XWiki经常部署在面向互联网的服务器 上，其请求处理和脚本逻辑中的安全漏洞可能产生严重的现实影响。 漏洞摘要 CVE ID: CVE-2025-24893 类别：...

CVE-2026-33137

CVE-2026-33137 XWiki Platform - 通过 REST/wikis/wikiName 实现未认证的 XAR 导入 描述 XWiki Platform 中的 POST /wikis/wikiName REST API 端点会执行 XAR（XWiki Archive）导入，且不进行任何身份验证或授权检查 。未认证的攻击者可以通过发送精心构造的 XAR 文件，在目标 wiki 中创建或更新任意文档。 CVE ：CVE-2026-33137 CWE ：CWE-862 缺失授权 CVSS 4.0 ：9.3（严重）-...

CVE-2020-13654

CVE-2020-13654 - XWiki Platform 发现并报告者： Astaruf 完整分析文章： https://nstsec.com/en/posts/xwiki-xss-cve-2020-13654/ NVD 条目： https://nvd.nist.gov/vuln/detail/CVE-2020-13654 漏洞详情 XWiki Platform 12.8 之前版本 未对用户个人资料编辑器中的用户可控字段进行 HTML 编码。经研究确认受影响的字段为"公司"（位于 编辑 → 个人信息 下），但其他个人资料字段共享相同的代码路径。...

CVE-2025-24893-XWiki-SSTI-RCE

CVE-2025-24893 — XWiki SSTI 远程代码执行 概述 字段| 详情 ---|--- CVE| CVE-2025-24893 软件| XWiki 漏洞| 服务端模板注入 SSTI → 远程代码执行 RCE 认证| 不需要 CVSS 评分| 严重 背景| 在 HackTheBox CTF 期间发现 描述 XWiki 暴露了一个 SolrSearch 端点 /xwiki/bin/get/Main/SolrSearch，该端点直接将用户输入渲染到 Groovy 模板引擎中，且未进行任何清理。未认证的攻击者可以通过 text 查询参数注入 Groovy...

GHSA-45PH-GXXR-GWGW XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

Exploit for Eval Injection in Xwiki

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE...

CVE-2026-48048

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to...

CVE-2026-48048

XWiki Platform is vulnerable due to an insufficient patch for GHSA-5cf8-vrr8-8hjm in the LiveTableResults endpoint. Affected versions are 6.2.1 and earlier than 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17. By sending slightly modified parameters to LiveTableResults, an attacker can reconstruct a us...

CVE-2026-48048 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to...

CVE-2026-48047

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047

Affected component: XWiki Platform WebJars API (org.xwiki.platform:xwiki-platform-webjars-api). Vulnerability: Path traversal that can let an attacker write arbitrary files (e.g., configuration files or superadmin password) after installing a malicious WebJar extension and publishing it to a conf...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70600 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70600 Source advisory: SNYK:JS-ELECTRON-18563354...

GHSA-QJ4X-9G63-25G6 XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

Impact With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access. For example http://host/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd allows downloading the content of the /etc/passwd file, provided Jetty is allowed...

Remote Code Execution

com.xwiki.pro, xwiki-pro-macros is vulnerable to Remote Code Execution. The vulnerability is due to the excerpt-include macro improperly escaping the title of the included page and executing the excerpt content with the macro's privileges, which allows an attacker to inject XWiki syntax through a...