CVE-2025-32968 json
org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
published 2025-04-23 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-12169 , GHSA-g9jj-75mx-wjcx
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki. The protection added to this REST API is the same as the one used to validate complete select queries, making it more consistent. However, while the script API always had this protection for complete queries, it's important to note that it's a very strict protection and some valid, but complex, queries might suddenly require the author to have programming right.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-oldcore 15.10.16, 16.4.6, 16.10.1
- org.xwiki.platform xwiki-platform-oldcore 15.10.16, 16.4.6, 16.10.1
- xwiki xwiki 15.10.16, 16.4.6, 16.10.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-22718 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-oldcore | >=1.6-milestone-1, <15.10.16 >=16.0.0-rc-1, <16.4.6 >=16.5.0-rc-1, <16.10.1 |
15.10.16 16.4.6 16.10.1 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
jira.xwiki.org
/browse/XWIKI-22718
web, exploit, issue-tracking, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-g9jj-75mx-wjcx
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-32968
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2025-32968
- GitHub Advisory GHSA-g9jj-75mx-wjcx
- NVD CVE-2025-32968
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.