Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.

INFO

Published Date :

2025-07-24T22:22:35.102Z

Last Modified :

2025-07-25T13:32:47.835Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-32429 vulnerability.

Vendors Products
Xwiki
  • Xwiki
  • Xwiki-platform
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-32429.

URL Resource
https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101 cve-icon cve-icon
https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3 cve-icon cve-icon
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq cve-icon cve-icon
https://jira.xwiki.org/browse/XWIKI-23093 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact