CVE-2025-32429: critical vulnerability in xwiki-platform
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
XWiki's deleted documents page allows attackers to inject malicious SQL commands through the sort parameter, potentially exposing or manipulating sensitive database information without authentication.
SQL injection vulnerability in getdeleteddocuments.vm template where the sort parameter is directly embedded into ORDER BY clauses without sanitization. Affects unauthenticated users; exploitation requires network access to the XWiki instance. Impact includes unauthorized data access, modification, or deletion from the underlying database.
In the same product, most dangerous first.