QwikSec

Security Database

CVE

CWE

Training

CVE-2024-56158

Published: Jun 12, 2025

Modified: Jan 12, 2026

PUBLISHED

Description

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.

Vendor	Product	Versions
xwiki	xwiki-platform	affected `>= 1.0, < 15.10.16` affected `>= 16.0.0-rc-1, < 16.4.7` affected `>= 16.5.0-rc-1, < 16.10.2`

Weaknesses (CWE)

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82

x_refsource_CONFIRM

https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d

x_refsource_MISC

https://jira.xwiki.org/browse/XWIKI-22734

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.