Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The xwiki-platform-oldcore package from org.xwiki.platform is vulnerable to SQL injection in short form select requests through the script query API in versions from 1.6-milestone-1 up to 15.10.16, from 16.0.0-rc-1 up to 16.4.6, and from 16.5.0-rc-1 up to 16.10.1. An attacker needs a user account with SCRIPT right, and can use it to escape the HQL context and run arbitrary SQL, potentially reading confidential data such as password hashes or modifying the database. Upgrade to 15.10.16, 16.4.6, or 16.10.1; the source lists no workaround other than upgrading.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.6 | High | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0059, the 48th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:11 UTC First seen by agentprime
- 31 Oct 2026, 15:11 UTC Confirmed by OSV