3570 matches found
PT-2025-47412
Name of the Vulnerable Software and Affected Versions XWiki AdminTools versions prior to 1.1 Description XWiki AdminTools provides administrative tools for managing a running XWiki instance. Prior to version 1.1, users lacking administrator privileges could access the AdminTools.SpammedPages page...
RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet
The botnet malware known as RondoDox has been observed targeting unpatched XWiki instances against a critical security flaw that could allow attackers to achieve arbitrary code execution. The vulnerability in question is CVE-2025-24893 CVSS score: 9.8, an eval injection bug that could allow any...
November “In the Trend of VM” (#21): vulnerabilities in Windows, SharePoint, Redis, XWiki, Zimbra Collaboration, and Linux
November "In the Trend of VM" 21: vulnerabilities in Windows, SharePoint, Redis, XWiki, Zimbra Collaboration, and Linux. The usual monthly roundup. After several months, here's a big one. Post on Habr rus Post on SecurityLab rus Digest on the PT website rus A total of nine vulnerabilities: RCE -...
Exploit for Code Injection in Xwiki
CVE-2025-24893-PoC XWiki Unauthenticated RCE Exploit for Reve...
About Remote Code Execution – XWiki Platform (CVE-2025-24893) vulnerability
About Remote Code Execution - XWiki Platform CVE-2025-24893 vulnerability. XWiki is a free and open-source wiki platform written in Java, with a strong focus on extensibility. It supports WYSIWYG visual editing, importing and exporting documents in OpenDocument format, adding annotations and tags...
VulnCheck KEV: CVE-2025-32429
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...
Exploit for Eval Injection in Xwiki
...
VulnCheck KEV: CVE-2025-55748
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-24893link is external XWiki Platform Eval Injection Vulnerability CVE-2025-41244link is external Broadcom VMware Aria Operations and VMware Tools Privilege...
XWiki Platform Eval Injection Vulnerability
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch...
Hackers Hijack Corporate XWiki Servers for Crypto Mining
Hackers exploit critical XWiki flaw CVE-2025-24893 to hijack corporate servers for cryptomining, with active attacks confirmed by VulnCheck researchers...
Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack
Threat actors are actively exploiting multiple security flaws impacting Dassault Systèmes DELMIA Apriso and XWiki, according to alerts issued by the U.S. Cybersecurity and Infrastructure Security Agency CISA and VulnCheck. The vulnerabilities are listed below - CVE-2025-6204 CVSS score: 8.0 - A...
The vulnerability of the Solr service on the XWiki Platform, a platform for creating collaborative web applications, allows a hacker to delete any files they desire.
The vulnerability of the Solr service, a platform for creating collaborative web applications, affects the XWiki Platform. This vulnerability can allow a malicious actor to delete arbitrary files remotely...
The vulnerability of the LESS script interface of the compiler used in the XWiki Platform, a platform for creating collaborative web applications, allows attackers to slow down the platform’s operation time.
The vulnerability of the LESS script API interface of the XWiki Platform, a platform for creating collaborative web applications, is related to improper authentication. Exploiting this vulnerability can allow an attacker to slow down the platform’s operation remotely...
The vulnerability of the org.xwiki.platform:xwiki-platform-skin-skinx component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to compromise the confidentiality of protected information.
The vulnerability of the org.xwiki.platform:xwiki-platform-skin-skinx component of the XWiki Platform framework is related to errors in processing the relative path to the directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of protected...
Vulnerability of the HTTP Meta Info fields, Footer Copyright, and Footer Version fields in the administration interface for creating collaborative web applications – XWiki Platform. This allows attackers to perform cross-site scripting attacks (XSS).
The vulnerabilities of the HTTP Meta Info, Footer Copyright, and Footer Version fields in the administration interface for the XWiki Platform’s collaborative web applications are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities could allow...
CVE-2025-49594
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-52472
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the orderField parameter. The specified value is...
