CVE-2024-56158: XWiki

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.

Affected products

• XWiki XWiki: from 1.0, before 15.10.16 (fixed in 15.10.16); from 16.0.0, before 16.4.7 (fixed in 16.4.7); from 16.5.0, before 16.10.2 (fixed in 16.10.2)

Published 2025-06-12. Last modified 2026-06-17.