xwiki-cve-2025-24893-poc

XWiki RCE Exploit PoC CVE-2025-24893 Overview This repository contains a Proof of Concept PoC exploit for the XWiki Remote Code Execution RCE vulnerability identified as CVE-2025-24893. The vulnerability allows an attacker to execute arbitrary code on a target XWiki instance by leveraging a craft...

CVE-2025-24893

XWiki SSTI Exploit A Python exploit for XWiki Server-Side Template Injection SSTI vulnerability via Groovy template injection in the SolrSearch endpoint. Vulnerability Type : Server-Side Template Injection SSTI Component : XWiki SolrSearch RSS feed Impact : Remote Code Execution Affected Version ...

CVE-2025-24893-XWiki-RCE

📜 Description A critical RCE vulnerability exists in XWiki that allows unauthenticated attackers to execute arbitrary system commands via vulnerable API endpoints. Exploitation can result in: Full server takeover Data theft or destruction Pivoting into internal networks 💥 Impact Complete compromi...

CVE-2025-24893

CVE-2025-24893 Exploit Title: XWiki 15.10.10 - Unauthenticated Remote Code Execution Date: 09/08/2025 Exploit Author: D3Ext Vendor Homepage: https://www.xwiki.org/ Software Link: https://github.com/xwiki/xwiki-platform Version: 15.10.10 Tested on: Kali Linux 2025 CVE: CVE-2025-24893 Explanation...

cve-2025-24893

CVE-2025-24893 XWiki RCE Exploit A simple Python3 script to exploit CVE-2025-24893 , a remote code execution vulnerability in XWiki Platform, using a Groovy-based async macro and a configurable reverse shell payload. ⚠️ WARNING: This tool is provided for educational and authorized testing purposes...

CVE-2025-24893

XWiki CVE-2025-24893 Proof of Concept Authors : Net.Doge & Infinit3i This Python script exploits CVE-2025-24893 , a remote code execution RCE vulnerability in XWiki caused by improper sandboxing in Groovy macros rendered asynchronously. It allows arbitrary command execution through injection into...

CVE-2025-24893

CVE-2025-24893 XWiki Remote Code Execution RCE Exploit A Python3 exploit for CVE-2025-24893 , a critical Unauthenticated Remote Code Execution RCE vulnerability affecting the XWiki platform. This script exploits a Code/Expression Injection flaw CWE-95 within the SolrSearch macro component. The fl...

CVE-2025-24893-RCE-PoC

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Installation python3 -m pip install requirements.txt Usage Connecting python3 poc.py Example With debug set to False default python...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting python3 poc.py Example With debug set to False default python3 poc.py http://127.0.0.1:8080 Targeting...

cve-2025-24893-poc

CVE-2025-24893 — XWiki Unauthenticated RCE PoC Proof-of-Concept exploit for CVE-2025-24893 , a critical unauthenticated Remote Code Execution vulnerability in XWiki. This exploit abuses a Groovy template injection in the SolrSearch endpoint to execute arbitrary commands — including reverse shells...

CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch

CVE-2025-24893 – Unauthenticated Remote Code Execution in XWiki 0 Table of Contents 1. Summary 2. Vulnerability Details 3. Affected Versions 4. Proof-of-Concept 4.1 Building the payload 4.2 Manual exploitation 4.3 Automated python exploit 5. Mitigation 6. Credits & References 1 Summary CVE:...

CVE-2026-33229

CVE-2026-33229 — XWiki RCE via Apache Velocity Sandbox Bypass A Remote Code Execution vulnerability in XWiki Platform that allows an authenticated user with scripting permissions to bypass the Apache Velocity sandbox entirely — no Java Reflection required — by traversing pre-instantiated objects...

CVE-2025-32429-Checker

CVE-2025-32429 Vulnerability Checker A Python-based vulnerability scanner for detecting CVE-2025-32429 SQL injection vulnerability in XWiki platforms. Features Single Target Scanning : Check individual targets with -t option Bulk Scanning : Scan multiple targets from a file with -l option WAF...

CVE-2025-24893

PoC for CVE-2025-24893 — XWiki Remote Code Execution Safe PoC PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11 , 16.4.1 and 16.5.0RC1. ⚠️ IMPORTANT — AUTHORIZED TESTING ONLY This repository contains a proof-of-concept PoC project intended for educational...

CVE-2025-24893-PoC

CVE-2025-24893 - XWiki Remote Code Execution RCE An updated proof-of-concept PoC exploit for CVE-2025-24893 , a critical unauthenticated RCE vulnerability in XWiki. This version improves on the original by allowing arbitrary shell command execution and clean reverse shell injection. By:...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE A self-contained Docker lab that reproduces CVE-2025-24893, a Server-Side Template Injection in XWiki's SolrSearch RSS feed that leads to unauthenticated remote code execution. It runs the vulnerable version 15.10.10 and the patched...

CVE-2025-24893

CVE-2025-24893 XWiki Unauthenticated Remote code execution POC Vulnerability Description XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the...

CVE-2025-24893

Exploit for CVE-2025-24893 CVE-2025-24893 is a critical unauthenticated remote code execution RCE vulnerability affecting the XWiki Platform. This flaw lets any guest user inject and execute arbitrary Groovy code —without authentication—via a specially crafted RSS request to the SolrSearch...

cov-int

XWiki Commons XWiki Commons are technical libraries common to several other top level XWiki projects. These libraries can be used by projects outside of the XWiki ecosystem, are generic and not related to the wiki domain. XWiki Platform, XWiki Commons and XWiki Rendering are part of the XWiki.org...

codeql-workshop-cve-2021-21380

CodeQL workshop for Java: Finding a SQL injection In this workshop we will use syntactical and semantic reasoning to find a SQL injection in the XWiki platform's rating component documented by CVE-2021-21380 Contents CodeQL workshop for Java: Finding a SQL injection Contents Prerequisites and set...