PT-2025-30704 · Xwiki · Xwiki Platform

Aleksey Solovev · Published 2025-04-10 · Updated 2026-04-07 · CVE-2025-32429

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2

Description XWiki Platform, a generic wiki platform, has a SQL injection issue in the getdeleteddocuments.vm template. The vulnerability occurs due to a failure to sanitize the sort parameter, allowing an attacker to inject SQL code as an ORDER BY value. Approximately 6,900 instances of XWiki Platform are publicly accessible annually.

Recommendations Update to version 16.10.6 or 17.3.0-rc-1.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-09129

CVE-2025-32429

GHSA-VR59-GM53-V7CQ

Affected Products

Xwiki Platform

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32429.json · Exploit
• 🔥 https://exploit-db.com/exploits/52384 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3 · Patch
• https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101 · Patch
• https://osv.dev/vulnerability/CVE-2025-32429 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-23093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32429 · Security Note
• https://osv.dev/vulnerability/GHSA-vr59-gm53-v7cq · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09129 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CVEnew/status/1948513847439946221 · Twitter Post
• https://leakix.net/search?q=%2Bplugin%3AXWikiPlugin&scope=leak · Reddit Post
• https://twitter.com/d4rk_c0r3/status/1949726227465486791 · Twitter Post
• https://twitter.com/HunterMapping/status/1949661244769603627 · Twitter Post