CVE-2025-54385

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki#searchDocuments APIs pass queries directly to Hibernate without sanitization. Even when these APIs enforce a specific SELECT clause, attackers can still inject malicious code through HQL's native function support in other parts of the query (such as the WHERE clause). This is fixed in versions 16.10.6 and 17.3.0-rc-1.

• CWE-20

• https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.htmlProduct
• https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51Patch
• https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9qm-p942-q3w5Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22728Vendor Advisory
• https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.6Release Notes

Published

Jul 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54379LF Edge eKuiper is a lightweight IoT data analytics and stre…9.8
• CVE-2025-5438A vulnerability was found in Linksys RE6500, RE6250, RE6300,…8.8
• CVE-2025-54380Opencast is a free, open-source platform to support the mana…6.5
• CVE-2025-54381BentoML is a Python library for building online serving syst…9.9
• CVE-2025-54382Cherry Studio is a desktop client that supports for multiple…8.8
• CVE-2025-54384CKAN is an open-source DMS (data management system) for powe…6.3
• CVE-2025-54386Traefik is an HTTP reverse proxy and load balancer. In versi…9.8
• CVE-2025-54387IPX is an image optimizer powered by sharp and svgo. In vers…9.8
• CVE-2025-54388Moby is an open source container framework developed by Dock…4.6
• CVE-2025-54389AIDE is an advanced intrusion detection environment. Prior t…5.5
• CVE-2025-5439A vulnerability was found in Linksys RE6500, RE6250, RE6300,…8.8
• CVE-2025-54390A Cross-Site Request Forgery (CSRF) vulnerability exists in …6.3