CVE-2025-54385 XWiki Platform's searchDocuments API allows for SQL injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

CVE-2025-54385 XWiki Platform's searchDocuments API allows for SQL injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

CVE-2025-54385

XWiki Platform contains a SQL injection vulnerability in the searchDocuments API. Affected versions are 17.0.0-rc1 through 17.2.2 and 16.10.5 and earlier. The issue arises because queries are passed directly to Hibernate without adequate sanitization, allowing injection of malicious SQL (e.g., vi...

CVE-2025-54385 XWiki Platform's searchDocuments API allows for SQL injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

XWiki Platform 输入验证错误漏洞

XWiki Platform is the XWiki open source suite of Wiki platforms for creating web collaboration applications. An input validation error vulnerability exists in XWiki Platform versions 17.0.0-rc1 through 17.2.2 and 16.10.5 and earlier, which stems from an uncleaned SQL query and could lead to a SQL...

Exploit for CVE-2025-32429

CVE-2025-32429 XWiki SQL Injection PoC Author: Byte Reape...

GHSA-P9QM-P942-Q3W5 XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

Impact It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWikisearchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query for example in the...

SQL Injection

Overview org.xwiki.platform:xwiki-platform-oldcore is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of this package are vulnerable to SQL Injection via the searchDocuments API. An attacker can execute arbitrary SQL queries on the underlyi...

XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

Impact It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWikisearchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query for example in the...

PT-2025-30912 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: xWiki versions prior to 16.10.6 xWiki versions prior to 17.3.0-rc-1 Description: The application allows execution of arbitrary SQL queries in Oracle databases using functions like DBMS XMLGEN or DBMS XMLQUERY. The XWikisearchDocuments API doe...

CVE-2025-32429

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

SQL Injection

Overview org.xwiki.platform:xwiki-platform-web-templates is a Web Resources for the XWiki platform. Affected versions of this package are vulnerable to SQL Injection via the sort parameter in the getdeleteddocuments.vm template. An attacker can execute arbitrary SQL commands by supplying crafted...

CVE-2025-32429 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2025-32429 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2025-32429 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2025-32429

XWiki Platform contains an SQL injection in the getdeleteddocuments.vm template via the sort parameter (LiveData REST), affecting versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2. The vulnerability allows injection of SQL by injecting the ORDER BY value, with impact described as d...

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

Impact It's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. One can see the result of the injection with...

GHSA-VR59-GM53-V7CQ XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

Impact It's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. One can see the result of the injection with...

XWiki Platform SQL注入漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A SQL injection vulnerability exists in XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, which stems from a misbehavior of the parameter sort in...

XWiki User Registration Remote Code Execution

XWiki Platform versions from 2.2 before 14.10.17, from 15.0-rc-1 before 15.5.3, and from 15.6-rc-1 before 15.8-rc-1 suffer from a Server-Side Template Injection SSTI due to the lack of sanitization of the user registration form's inputs. By leveraging this vulnerability, a remote and...