Exploit for CVE-2025-24893-

kitploit · 2026-09-01

Description

Remote code execution in XWiki platform with available proof of concept.

Entry point

Parametertext · query param

Pathxwiki/bin/get/Main/SolrSearch?media=rss&text=PAYLOAD

XWiki SolrSearch SSTI/RCE via crafted Groovy injection in SolrSearch endpoint (unauthenticated).

Affected Xwiki versions

Xwiki< 15.10.11, 16.4.1, 5.3

All known vulnerabilities by product

CVSS 9.8 for CVE-2025-24893

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-09-01 01:43

Last Seen:2026-09-04 23:43

Reporter:KitPloit

Tags

XWiki PlatformRemote Code ExecutionProof of ConceptWeb Application

Other exploits for CVE-2025-24893

2026-09-13 KitPloitKITPLOIT

CVE-2025-24893-PoC

2026-09-13 KitPloitKITPLOIT

2026-09-13 KitPloitKITPLOIT

2026-09-13 KitPloitKITPLOIT

CVE-2025-24893-PoC

2026-09-13 KitPloitKITPLOIT

2026-09-13 KitPloitKITPLOIT

2026-09-13 KitPloitKITPLOIT

CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch

2026-09-13 KitPloitKITPLOIT

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-NOHACK1212-CVE-2025-24893-
# CVE-2025-24893-

CVE-2025-24893 | Уязвимость удаленного выполнения кода на платформе XWiki (доказательство концепции)