PT-2025-30704

CVE-2025-32429

Published

2025-04-10

Updated

2026-10-05

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2

Description XWiki Platform, a generic wiki platform, has a SQL injection issue in the getdeleteddocuments.vm template. The vulnerability occurs due to a failure to sanitize the sort parameter, allowing an attacker to inject SQL code as an ORDER BY value. Approximately 6,900 instances of XWiki Platform are publicly accessible annually.

Recommendations Update to version 16.10.6 or 17.3.0-rc-1.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2025-32429