Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
XWikiplatform Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2025-32429 - Vulnerability Database
XWikiplatform

XWikiplatform Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2025-32429

Critical
Reference: CVE-2025-32429
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-32429
Title: XWikiplatform Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability
Overview:

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2 it39s possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It39s injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.