CVE

CVE-2025-32429

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

xwiki-platform

Updated Oct 24, 2026View on NVD →

This CVE is in S4E's catalog, but no public scanner is mapped to it yet.

CVE history: xwiki-platform

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →