CVE-2025-66472

MEDIUM NUCLEI

XWiki Platform <16.10.9, <17.0.0-rc-1 to <17.4.1 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-66472 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

Nuclei Templates (1)

XWiki DeleteApplication - Cross-Site Scripting
MEDIUMVERIFIEDby ritikchaddha
Shodan: html:"data-xwiki-reference"
FOFA: body="data-xwiki-reference"

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0009
EPSS Percentile 26.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-80 CWE-79
Status published
Products (3)
org.xwiki.platform/xwiki-platform-flamingo-skin-resources 6.2-milestone-1 - 16.10.10Maven
org.xwiki.platform/xwiki-platform-web-templates 6.2-milestone-1 - 16.10.10Maven
xwiki/xwiki 6.2 - 16.10.10
Published Dec 10, 2025
Tracked Since Feb 18, 2026