CVE-2025-32429

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2

Description XWiki Platform, a generic wiki platform, has a SQL injection issue in the getdeleteddocuments.vm template. The vulnerability occurs due to a failure to sanitize the sort parameter, allowing an attacker to inject SQL code as an ORDER BY value. Approximately 6,900 instances of XWiki Platform are publicly accessible annually.

Recommendations Update to version 16.10.6 or 17.3.0-rc-1.