QwikSec

Security Database

CVE

CWE

Training

CVE-2025-32429

Published: Jul 24, 2025

Modified: Jul 25, 2025

PUBLISHED

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.

Vendor	Product	Versions
xwiki	xwiki-platform	affected `>= 9.4-rc-1, < 16.10.6` affected `>= 17.0.0-rc-1, < 17.3.0-rc-1`

Weaknesses (CWE)

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq

x_refsource_CONFIRM

https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101

x_refsource_MISC

https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3

x_refsource_MISC

https://jira.xwiki.org/browse/XWIKI-23093

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.