PT-2025-50546 · Xwiki · Xwiki Platform Flamingo Skin Resources+1

Published 2025-05-25 · Updated 2026-02-18 · CVE-2025-66472

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XWiki Platform Flamingo Skin Resources versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 XWiki Platform Web Templates versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1

Description The XWiki Platform is a wiki platform that provides runtime services for applications. Affected versions are susceptible to a reflected cross-site scripting (XSS) attack. The attack occurs through a deletion confirmation message, where an attacker-supplied script is executed when a victim clicks the "No" button.

Recommendations Update XWiki Platform Flamingo Skin Resources to version 16.10.10 or later. Update XWiki Platform Web Templates to version 16.10.10 or later. Update XWiki Platform Flamingo Skin Resources to version 17.4.2 or later. Update XWiki Platform Web Templates to version 17.4.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2025-15980

CVE-2025-66472

GHSA-7VPR-JM38-WR7W

Affected Products

Xwiki Platform Flamingo Skin Resources

Xwiki-Platform-Web-Templates

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66472.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2 · Patch
• https://jira.xwiki.org/browse/XWIKI-23244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66472 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66472 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15980 · Security Note
• https://twitter.com/pdnuclei_bot/status/2011981764231905422 · Twitter Post
• https://twitter.com/CVEnew/status/1999108908749815860 · Twitter Post
• https://t.me/cveNotify/152357 · Telegram Post
• https://t.me/CVEtracker/39414 · Telegram Post