EXPOSURES › CVE-2025-24893

CVE-2025-24893

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2025-10-30 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2025-24893 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 rceexploited-in-wildunpatched

XWiki Platform allows remote code execution through SolrSearch due to eval injection

XWiki's Platform suffered an eval injection vulnerability, enabling remote code execution through SolrSearch, as confirmed by KEV. This exposed DIB orgs to potential ransomware attacks, compromising data integrity and availability.

Shame score — Critical remote code execution vulnerability actively exploited in the field

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

XWiki · vendor Platform · product

DESCRIPTION

XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.