CVE-2025-32969
CRITICALCVSS v3
9.8
CRITICAL
EPSS Score
26.2%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.
Technical Details
- Published
- 4/23/2025
Frequently Asked Questions
What is CVE-2025-32969?
XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.
Is CVE-2025-32969 actively exploited?
Active exploitation of CVE-2025-32969 has not been confirmed. The EPSS score is 26.2%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2025-32969?
CVE-2025-32969 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2025-32969 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.