CVE-2025-51990 describes multiple stored Cross-Site Scripting (XSS) vulnerabilities in XWiki through version 17.3.0, specifically within the Administration interface's Global Preferences. An authenticated administrator can inject malicious JavaScript into various fields, which is then rendered on public-facing pages without proper sanitization, affecting all visitors. This vulnerability has a CVSS score of 4.8 (Medium) due to its reliance on administrator credentials and user interaction for execution, but successful exploitation can lead to session hijacking or credential theft. While no active exploitation or Metasploit modules are reported, Nuclei templates exist, and there is currently no significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 17.3.0CPE matchmatch criteria | cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.