Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-32429

89
FAUCET Score

CVE-2025-32429 is a critical SQL injection vulnerability affecting XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2. This flaw allows unauthenticated attackers to inject SQL commands via the 'sort' parameter in getdeleteddocuments.vm. With a CVSS score of 9.8, it poses a severe risk, enabling full compromise of confidentiality, integrity, and availability. While not yet in CISA's KEV catalog, public exploit code exists on ExploitDB and Nuclei templates are available, indicating a high likelihood of exploitation. The vulnerability has garnered significant community discussion, underscoring its importance for immediate patching to versions 16.10.6 or 17.3.0-rc-1.

Impacted Technologies

VendorProductVersion(s)CPE
>= 9.4, < 16.10.6CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
>= 17.0.0, <= 17.2.2CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

9.3CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
85.41%
Probability of exploitation in next 30 days
EPSS Percentile
99.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
Nuclei: CVE-2025-32429 · Nov 3, 2025
ExploitDB: EDB-52384 · Jul 28, 2025
This CVE's current EPSS score of 0.8541 is in the 99th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-distribution-warFixed in: 16.10.6
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-distribution-warFixed in: 17.3.0-rc-1

Vendor Advisories (1)

mavenGHSA-vr59-gm53-v7cqcritical

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

Jul 24, 2025

References

github.com / xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101
Patch
github.com / xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3
Patch
github.com / xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq
Vendor Advisory
jira.xwiki.org / browse/XWIKI-23093
Issue TrackingVendor Advisory