CVE-2025-66472

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66472
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66472.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66472
Aliases
Published
2025-12-10T21:34:47.460Z
Modified
2026-03-13T03:42:07.398456Z
Severity
  • 6.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66472.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
c427b927d0904c5989881dbf21d3f486eb0bf4ed
Fixed
aa2cc23219a3df3fc651360b00769e0332b2a305
Introduced
7edb5b7d98170ec081c7e30237971d7dfb8a4401
Fixed
55ef6325bb07177d283e8e84040a6c65afebb3d7
Fixed
cb578b1b2910d06e9dd7581077072d1cfbd280f2
Database specific 
{
    "versions": [
        {
            "introduced": "6.2"
        },
        {
            "fixed": "16.10.10"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.4.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66472.json"