{"id":"CVE-2025-32429","aliases":["EUVD-2025-22551","GHSA-vr59-gm53-v7cq"],"status":"published","title":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.85496,"percentile":0.99724,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2025-07-24T18:09:01Z","modified":"2026-10-28T10:40:35Z","exploits":[{"source":"exploitdb","id":"EDB-52384","title":"XWiki 14 - SQL Injection via getdeleteddocuments.vm","type":"webapps","platform":"multiple","date":"2025-07-28","url":"https://www.exploit-db.com/exploits/52384"},{"source":"nuclei","id":"CVE-2025-32429","title":"XWiki Platform - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32429.yaml"},{"source":"pocgithub","id":"amir-othman/CVE-2025-32429","title":"amir-othman/CVE-2025-32429","date":"2025-07-26","url":"https://github.com/amir-othman/CVE-2025-32429"},{"source":"pocgithub","id":"byteReaper77/CVE-2025-32429","title":"byteReaper77/CVE-2025-32429","date":"2025-07-25","url":"https://github.com/byteReaper77/CVE-2025-32429"},{"source":"pocgithub","id":"imbas007/CVE-2025-32429-Checker","title":"imbas007/CVE-2025-32429-Checker","date":"2025-07-28","url":"https://github.com/imbas007/CVE-2025-32429-Checker"}],"fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","fixed_in":["16.10.6","17.3.0-rc-1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4-rc-1"},{"fixed":"16.10.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0-rc-1"},{"fixed":"17.3.0-rc-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4-rc-1"},{"fixed":"16.10.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0-rc-1"},{"fixed":"17.3.0-rc-1"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-23093","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32429","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vr59-gm53-v7cq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32429.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-32429","title":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","status":"published","published":"2025-07-24T22:22:35.102Z","modified":"2025-07-25T13:32:47.835Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:46.42892Z"}],"euvd":[{"id":"EUVD-2025-22551","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","status":"published","published":"2025-07-24T22:22:35Z","modified":"2025-07-25T13:32:47Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T20:32:04.291169Z"}],"ghsa":[{"id":"GHSA-vr59-gm53-v7cq","title":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","description":"### Impact\n\nIt's possible for anyone to inject SQL using the parameter sort of the `getdeleteddocuments.vm`. It's injected as is as an ORDER BY value.\n\nOne can see the result of the injection with http://127.0.0.1:8080/xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm\u0026sort=injected (this example does not work, but it shows that an HQL query was executed with the passed value which look nothing like an order by value, without any kind of sanitation).\n\n### Patches\n\nThis has been patched in 17.3.0-rc-1, 16.10.6.\n\n### Workarounds\n\nThere is no known workaround, other than upgrading XWiki.\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-23093\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThe vulnerability was identifier by Aleksey Solovev from Positive Technologies.","status":"published","published":"2025-07-24T18:09:01Z","modified":"2025-07-25T13:32:03Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2025-32429","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","status":"published","published":"2025-07-24T23:15:26.283Z","modified":"2026-06-17T09:11:58.64Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:21.132141Z"}],"osv":[{"id":"CVE-2025-32429","title":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","status":"published","published":"2025-07-24T22:22:35.102Z","modified":"2026-10-28T10:40:35.609407659Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-vr59-gm53-v7cq","title":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","description":"### Impact\n\nIt's possible for anyone to inject SQL using the parameter sort of the `getdeleteddocuments.vm`. It's injected as is as an ORDER BY value.\n\nOne can see the result of the injection with http://127.0.0.1:8080/xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm\u0026sort=injected (this example does not work, but it shows that an HQL query was executed with the passed value which look nothing like an order by value, without any kind of sanitation).\n\n### Patches\n\nThis has been patched in 17.3.0-rc-1, 16.10.6.\n\n### Workarounds\n\nThere is no known workaround, other than upgrading XWiki.\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-23093\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThe vulnerability was identifier by Aleksey Solovev from Positive Technologies.","status":"published","published":"2025-07-24T18:09:01Z","modified":"2025-07-25T13:32:02Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}