CVE-2025-54124

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can create an XClass with a database list property that references a password property. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view. This issue is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1.

• CWE-359

• https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r38m-cgpg-qj69Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22811Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22811Exploit, Vendor Advisory

Published

Aug 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54119ADOdb is a PHP database class library that provides abstract…10
• CVE-2025-5412A vulnerability classified as problematic has been found in …5.4
• CVE-2025-54120PCL (Plain Craft Launcher) Community Edition is a Minecraft …9.3
• CVE-2025-54121Starlette is a lightweight ASGI (Asynchronous Server Gateway…5.3
• CVE-2025-54122Manager-io/Manager is accounting software. A critical unauth…10
• CVE-2025-54123Hoverfly is an open source API simulation tool. In versions …9.8
• CVE-2025-54125XWiki Platform is a generic wiki platform offering runtime s…6.5
• CVE-2025-54126The WebAssembly Micro Runtime's (WAMR) iwasm package is the …5.3
• CVE-2025-54127HAXcms with nodejs backend allows users to start the server …9.8
• CVE-2025-54128HAX CMS NodeJs allows users to manage their microsite univer…6.1
• CVE-2025-54129HAXiam is a packaging wrapper for HAXcms which allows anyone…4.3
• CVE-2025-54130Cursor is a code editor built for programming with AI. Curso…9.8