CVE

CVE-2025-52472

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

xwiki-platform

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalWeb Vulnerabilities~10 seconds

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration. References: https://jira.xwiki.org/browse/XWIKI-23247 https://nvd.nist.gov/vuln/detail/CVE-2025-52472 Remediation: Update XWiki to a version that patches this vulnerability. Review and sanitize all user-controlled parameters that are used in database queries, especially those passed to HQL queries.

url

Scanner page →Run scanner

CVE history: xwiki-platform

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →