CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2025-54125Public Exploit

XWiki-Platform - Credentials Disclosure (CVE-2025-54125)

PublishedAug 5, 2025
First SeenSep 6, 2025
Last Seen
Reported
CVSS8.7
XWiki
XWikiXWiki-Platform
wiki

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.

psychologyCrowdSec Analysis

CVE-2025-54125 is a high-severity vulnerability in XWiki Platform that allows any user with view rights to export sensitive information, such as passwords and emails stored under non-standard property names, by appending ?xpage=xml to a page URL. This flaw could be exploited by attackers to harvest confidential user data, potentially leading to further compromise or targeted attacks.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-54125 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending GET requests to user profile endpoints such as /bin/view/XWiki/<username>?xpage=xml or /xwiki/bin/view/XWiki/<username>?xpage=xml, which return XML data containing sensitive user information.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2025-08-05
Rule Released2025-09-03
CrowdSec First Seen2025-09-06

Related Weaknesses

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References