XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

XWiki's deleted documents page allows attackers to inject malicious SQL commands through the sort parameter, potentially exposing or manipulating sensitive database information without authentication.

SQL injection vulnerability in getdeleteddocuments.vm template where the sort parameter is directly embedded into ORDER BY clauses without sanitization. Affects unauthenticated users; exploitation requires network access to the XWiki instance. Impact includes unauthorized data access, modification, or deletion from the underlying database.