CVE-2025-54125

Summary

XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Severity

high

EPSS

1.2% (p64)

Also known as

GHSA-57q2-6cp4-9mq3#org.xwiki.platform:xwiki-platform-legacy-oldcore, GHSA-57q2-6cp4-9mq3#org.xwiki.platform:xwiki-platform-oldcore

Published

2025-08-05

References

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-57q2-6cp4-9mq3
• https://nvd.nist.gov/vuln/detail/CVE-2025-54125
• https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59

Related advisories

• CVE-2024-56158 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-43400 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-37899 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-31987 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-31981 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2026-33229 — high · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2025-54124 — high · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2025-54385 — high · Maven/org.xwiki.platform:xwiki-platform-oldcore

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity