Report feedback

An authenticated remote attacker, due to insufficient input sanitization in the XWiki#searchDocuments API function, is able to execute an arbitrary SQL query in an Oracle database, for example through functions such as DBMS_XMLGEN or DBMS_XMLQUERY [1].

The vulnerability is present in product:

• XWiki; >=17.0.0-rc1, <=17.2.2; <=16.10.5

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2025-54385 at cve.org, NVD
• CWE-20: Improper Input Validation at cwe.mitre.org

The vulnerability was publicly disclosed 26. 7. 2025.

An unauthenticated remote attacker with page read permission, due to a flaw in the XML export of a page (triggerable by appending ?xpage=xml to the URL), is able to obtain sensitive data, such as passwords or e-mails, if they are stored in properties other than those named "password" or "email" [2].

The vulnerability is present in product:

• XWiki; >=1.1, <16.4.7; >=16.5.0-rc-1, <16.10.5; >=17.0.0-rc-1, <17.2.0-rc-1

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

• CVE-2025-54125 at cve.org, NVD
• CWE-359: Exposure of Private Personal Information to an Unauthorized Actor at cwe.mitre.org

The vulnerability was publicly disclosed 5. 8. 2025.

An authenticated remote attacker, due to the ability to create an XClass with a database property referencing a password field, is able to display its content, which under the default permission settings allows them to obtain other users' password hashes and other sensitive data from pages they have access to [3].

The vulnerability is present in product:

• XWiki; >=9.8-rc-1, <16.4.7; >=16.5.0-rc-1, <16.10.5; >=17.0.0-rc-1, <17.2.0-rc-1

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

• CVE-2025-54124 at cve.org, NVD
• CWE-359: Exposure of Private Personal Information to an Unauthorized Actor at cwe.mitre.org

The vulnerability was publicly disclosed 5. 8. 2025.

An unauthenticated remote attacker, due to a reflected XSS vulnerability in two XWiki templates, is able to run malicious JavaScript code in the context of the victim's session by having them visit an attacker-controlled URL, and thereby perform arbitrary actions with the victim's privileges [4].

The vulnerability is present in product:

• XWiki; >=4.2-milestone-3, <16.4.8; >=16.5.0-rc-1, <16.10.6; >=17.0.0-rc-1, <17.3.0-rc-1

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

More information:

• CVE-2025-32430 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 8. 2025.