CVE-2025-32429

Published Jul 24, 2025·Updated Jun 17, 2026

NVD Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.

Public Exploits & PoCs2 found

PoC: CVE-2025-32429

Exploit for CVE-2025-32429 – SQLi in XWiki REST API (getdeleteddocuments.vm).

PoC: CVE-2025-32429

Proof-of-Concept exploit for CVE-2025-32429 (SQL Injection in PHP PDO prepared statements) – for educational and security research purposes only

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free