{"id":"CVE-2025-32429","published":"2025-07-24T22:22:35Z","modified":"2025-07-25T13:32:47Z","title":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 9.4-rc-1, < 16.10.6",">= 17.0.0-rc-1, < 17.3.0-rc-1"]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","provenance":"source","from":"CVE.org"},"summary":{"text":"The XWiki Platform (xwiki-platform) has an SQL injection flaw in the sort parameter of its getdeleteddocuments.vm template, where the value is inserted unmodified as an ORDER BY clause. An attacker with network access can exploit it without authentication or user interaction, with no special configuration needed, to read, modify, or disrupt the underlying database.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:32:08Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.85496,"percentile":0.99722,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-11-03","exploitedFirstSeen":"2025-11-03","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-32429","date":"2025-11-03"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101","tags":["x_refsource_MISC"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-23093","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=9.4-rc-1, <16.10.6",">=17.0.0-rc-1, <17.3.0-rc-1"],"patched":["16.10.6","17.3.0-rc-1"],"from":["GHSA-vr59-gm53-v7cq"],"provenance":"source"}],"advisories":[{"id":"GHSA-vr59-gm53-v7cq","url":"https://github.com/advisories/GHSA-vr59-gm53-v7cq","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=9.4-rc-1, <16.10.6"],"patched":["16.10.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vr59-gm53-v7cq","url":"https://github.com/advisories/GHSA-vr59-gm53-v7cq","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=17.0.0-rc-1, <17.3.0-rc-1"],"patched":["17.3.0-rc-1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-22551","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22551","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52384,"url":"https://www.exploit-db.com/exploits/52384","title":"XWiki 14 - SQL Injection via getdeleteddocuments.vm","type":"webapps","platform":"multiple","date":"2025-07-28","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-07-28"},"pocGithub":{"count":2,"skipped":1,"earliest":"2025-07-25","earliestUrl":"https://github.com/byteReaper77/CVE-2025-32429","repos":[{"name":"byteReaper77/CVE-2025-32429","url":"https://github.com/byteReaper77/CVE-2025-32429","stars":10,"created":"2025-07-25"},{"name":"amir-othman/CVE-2025-32429","url":"https://github.com/amir-othman/CVE-2025-32429","stars":0,"created":"2025-07-26"}]},"nuclei":[{"id":"CVE-2025-32429","name":"XWiki Platform - SQL Injection","severity":"critical","path":"http/cves/2025/CVE-2025-32429.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32429.yaml"}],"first":{"date":"2025-07-25","source":"PoC-in-GitHub","url":"https://github.com/byteReaper77/CVE-2025-32429"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-07-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-32429","provenance":"source"},{"date":"2025-07-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-07-28","url":"https://github.com/byteReaper77/CVE-2025-32429","provenance":"source"},{"date":"2025-11-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-32429","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":71.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 361 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9972"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}