{"id":"CVE-2025-54385","summary":"XWiki Platform's searchDocuments API allows for SQL injection","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki#searchDocuments APIs pass queries directly to Hibernate without sanitization. Even when these APIs enforce a specific SELECT clause, attackers can still inject malicious code through HQL's native function support in other parts of the query (such as the WHERE clause). This is fixed in versions 16.10.6 and 17.3.0-rc-1.","aliases":["GHSA-p9qm-p942-q3w5"],"modified":"2026-08-12T15:14:04.052955Z","published":"2025-07-26T03:28:49.269Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54385.json"},"references":[{"type":"WEB","url":"https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22728"},{"type":"WEB","url":"https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54385.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9qm-p942-q3w5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54385"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"ea21b6389eb2aeb9660ef5bc0bc38beeac372c9e"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"last_affected":"92d3468f1c4a24e16ee826e4be5eb6e7cb62474a"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"16.10.6"},{"introduced":"17.0.0"},{"last_affected":"17.2.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"0708ca6ba734c6d79984d887b9afa11d7255d1a0"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"fixed":"7313dc9b533c70f14b7672379c8b3b63d1fd8f51"},{"fixed":"7c4087d44ac550610b2fa413dd4f5375409265a5"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"16.10.6"},{"introduced":"17.0.0"},{"last_affected":"17.2.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-17.2.2","xwiki-commons-17.2.1","xwiki-commons-17.2.0","xwiki-commons-17.2.0-rc-1","xwiki-commons-16.10.5","xwiki-commons-16.10.4","xwiki-commons-16.10.3","xwiki-commons-16.10.2","xwiki-commons-16.10.1","xwiki-commons-16.10.0","xwiki-commons-16.10.0-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-16.10.5","xwiki-platform-16.10.4","xwiki-platform-16.10.3","xwiki-platform-16.10.2","xwiki-platform-16.10.1","xwiki-platform-16.10.0","xwiki-platform-16.10.0-rc-1","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54385.json","vanir_signatures_modified":"2026-08-12T15:14:04Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java"},"deprecated":false,"digest":{"line_hashes":["241582243305560660683703848704536192322","292420817296359865746054357406297973361","684716775122726963588824468488557335","224342576138404750700220294021217583794","92956198238527460654207963068083821248","278563520227519008688217461387094554989","54740818318281813987682344054748188021","194299446694828852613923591418986370635","21047565407168812315863461360748203231","283148126975987556420048514658315402101","45196556889642988137520049574376371327","158570667186562673442356110285052254734","2065216079386583701100792069449605536","305214732762341637492071136131593101459","121027887750220197576649721271114056882","1382622768299201017721780303563694479","282991847383909388087344194350962022618","42793485828697964122146202601496555456","99781847695213870210988682440954899065","143135951436872895531537565808065743626","84553631919781678728590280463372387183","19396083244690554802182801164823087493","12220836766464494290384705662367954246","244020675492648125567794415802012278483","327760713678322664293693247505558337438","293445173757705728966912099275168875342","208360591795246855144686540822726410179","220774325329106769988231422505173118323","80802409309071831157622557008377588706","111411807623298472227847228485125570151","193449590521727488373351498168206557862","253412545748658220027654247353639569403","156808920975172531185380593748550879998","137380757258984826629552884231713920677","27569510816806892640963956088883918174","13220495546336977380997913324700958530","114022116682771793366249415445638123478","177406434669991272637938271205293738346","158064531238703843551490509137893838109","207311093445483604935608912227776797030","236364224513153701166018438265427373130","234963793601537092323401689276026997183","30654063349187897480930308286688655262","185408583565349959473802000507177133288","256518838941332758490548094668950716083","193534231654419485522873790593718503644","207144131450911209414103402977558116260","19900795226850117732806835796681181166","32830928272501909402482505164061418773","118820643029069691391693403753104043272","313377241140148196119130489664583307407","106023484316850116936321918048074489034","5024283803691574255684653613447754317","236682818850115378700648892758604335886","1723422124596608786548483884615489410","57028920366410905836075104017277194282","30681732879182837257649880483013113138","163186007758483310884624833711661390554","291569676745858957320647071302558765275","212882438618309960159079771670552320947","56839176744908763180627288438837716535"],"threshold":0.9},"id":"CVE-2025-54385-039593e2","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"function":"searchDocuments","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java"},"deprecated":false,"digest":{"length":164,"function_hash":"22375030463605506561926205117285174833"},"id":"CVE-2025-54385-0ba2961c","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"166720235714385980491196605768704908396","length":504},"id":"CVE-2025-54385-11da4d50","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java","function":"createSQLQuery"}},{"deprecated":false,"digest":{"function_hash":"77370202772405458445717369808134810712","length":136},"id":"CVE-2025-54385-120272a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtils.java","function":"isShortFormStatement"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"},"deprecated":false,"digest":{"function_hash":"327017709795260608375481087801523911548","length":129},"id":"CVE-2025-54385-1643b299","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java","function":"getColumnsForSelectStatement"},"deprecated":false,"digest":{"function_hash":"126168159367393670792274331244718521149","length":518},"id":"CVE-2025-54385-170aca8d"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"},"deprecated":false,"digest":{"function_hash":"135245229564741164769246771792633684521","length":195},"id":"CVE-2025-54385-1cb521bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5"},{"deprecated":false,"digest":{"function_hash":"92722563095591543684541981980313217142","length":251},"id":"CVE-2025-54385-20421ccb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchSpacesNames"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"},"deprecated":false,"digest":{"function_hash":"125427689649189658504245087717356656798","length":151},"id":"CVE-2025-54385-24baee4e","signature_type":"Function"},{"source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java"},"deprecated":false,"digest":{"line_hashes":["191125892844570076593936523616289153160","284215841558720354393957676143225536489","262324511828317801758852769408326432538","43840897825825568229833707742377011249","234564580379229320136430610317753245782","316395874285657247403572724115433852241","189074679660236353630954669484388837996","18152624420725402461309305067667747978","2268432378149448622666234899132010808","206976373439967402388950994416812300482","275234125354393413627671517464408264630","302330783693013633806201036184850200244","150390690481997892721471264867940124645","21238338354939865904694872201116072171","105629252392603673381158695146781412179","84685857648435984928699910594672241854","107195249391242676738439151070213942915","291817971693425400961059046488871481158","269243966060207276223214967794580881060","262366721042140498862463115355639933379","93497280638244518527761321158542484530","308254626141160155241897885370965759258","19411521285142044547309546958044915451","61187837367500007341714472971127682929","130923614771130636050220930676361664453","182777995749337181679850267173415136439","217331403518366980022253357938031303140","337462431460753736013411375486477430865","307545811260116142644025259583498579363","210787829798177798347426651321511390787","182334848519264948145974513802638469466","127541303002601779759528272727511920553","7786424745390768595025204574355454767","280612110165589959398745216104202713130","268731821388379655343113786856051587636","94657534721499728890475406621100643966","48758179592976889679941668859434664416","271704414020545291264709723645876203173","100021658481177570287809488875437575150","101465458291593085720592566063727908240","282632327375742991350824327553749157875","3958237280568412598073236381984977996","207176098971761150937219659867631023334","161295664106054709131730742781937414394","22217061272812861539931251390281533398"],"threshold":0.9},"id":"CVE-2025-54385-37b1aa54","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"231299613640396353134718958696365683282","length":208},"id":"CVE-2025-54385-3fdcd1ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchSpacesNames"},"deprecated":false,"digest":{"function_hash":"92722563095591543684541981980313217142","length":251},"id":"CVE-2025-54385-43bd3103","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["241582243305560660683703848704536192322","292420817296359865746054357406297973361","684716775122726963588824468488557335","224342576138404750700220294021217583794","92956198238527460654207963068083821248","278563520227519008688217461387094554989","54740818318281813987682344054748188021","194299446694828852613923591418986370635","21047565407168812315863461360748203231","283148126975987556420048514658315402101","45196556889642988137520049574376371327","158570667186562673442356110285052254734","2065216079386583701100792069449605536","305214732762341637492071136131593101459","121027887750220197576649721271114056882","1382622768299201017721780303563694479","282991847383909388087344194350962022618","42793485828697964122146202601496555456","99781847695213870210988682440954899065","143135951436872895531537565808065743626","84553631919781678728590280463372387183","19396083244690554802182801164823087493","12220836766464494290384705662367954246","244020675492648125567794415802012278483","327760713678322664293693247505558337438","293445173757705728966912099275168875342","208360591795246855144686540822726410179","220774325329106769988231422505173118323","80802409309071831157622557008377588706","111411807623298472227847228485125570151","193449590521727488373351498168206557862","253412545748658220027654247353639569403","156808920975172531185380593748550879998","137380757258984826629552884231713920677","27569510816806892640963956088883918174","13220495546336977380997913324700958530","114022116682771793366249415445638123478","177406434669991272637938271205293738346","158064531238703843551490509137893838109","207311093445483604935608912227776797030","236364224513153701166018438265427373130","234963793601537092323401689276026997183","30654063349187897480930308286688655262","185408583565349959473802000507177133288","256518838941332758490548094668950716083","193534231654419485522873790593718503644","207144131450911209414103402977558116260","19900795226850117732806835796681181166","32830928272501909402482505164061418773","118820643029069691391693403753104043272","313377241140148196119130489664583307407","106023484316850116936321918048074489034","5024283803691574255684653613447754317","236682818850115378700648892758604335886","1723422124596608786548483884615489410","57028920366410905836075104017277194282","30681732879182837257649880483013113138","163186007758483310884624833711661390554","291569676745858957320647071302558765275","212882438618309960159079771670552320947","56839176744908763180627288438837716535"],"threshold":0.9},"id":"CVE-2025-54385-47a3498c","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java"}},{"deprecated":false,"digest":{"function_hash":"231299613640396353134718958696365683282","length":208},"id":"CVE-2025-54385-4cb68eeb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtils.java"},"deprecated":false,"digest":{"line_hashes":["272090224881457459008762239553918850644","34740110834908771617930507535799615677","310827031151089562739373603685524120154","226795011496879246674668397895761962028","283806775082930531475230221803794604607","180005294112822231100258766961978949449","333974563594322073616547567539622279513","33003743002465478630591813668497679433","323962891915767702189139495090831255031","190312220973095710854643000099216669094","309426026466320386804633089264128105936"],"threshold":0.9},"id":"CVE-2025-54385-50171342","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"193011696447342420664751500634081573002","length":202},"id":"CVE-2025-54385-57d5e5c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchAttachments"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"},"deprecated":false,"digest":{"function_hash":"327017709795260608375481087801523911548","length":129},"id":"CVE-2025-54385-6641a12b","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["191125892844570076593936523616289153160","284215841558720354393957676143225536489","262324511828317801758852769408326432538","43840897825825568229833707742377011249","234564580379229320136430610317753245782","316395874285657247403572724115433852241","189074679660236353630954669484388837996","18152624420725402461309305067667747978","2268432378149448622666234899132010808","206976373439967402388950994416812300482","275234125354393413627671517464408264630","302330783693013633806201036184850200244","150390690481997892721471264867940124645","21238338354939865904694872201116072171","105629252392603673381158695146781412179","84685857648435984928699910594672241854","107195249391242676738439151070213942915","291817971693425400961059046488871481158","269243966060207276223214967794580881060","262366721042140498862463115355639933379","93497280638244518527761321158542484530","308254626141160155241897885370965759258","19411521285142044547309546958044915451","61187837367500007341714472971127682929","130923614771130636050220930676361664453","182777995749337181679850267173415136439","217331403518366980022253357938031303140","337462431460753736013411375486477430865","307545811260116142644025259583498579363","210787829798177798347426651321511390787","182334848519264948145974513802638469466","127541303002601779759528272727511920553","7786424745390768595025204574355454767","280612110165589959398745216104202713130","268731821388379655343113786856051587636","94657534721499728890475406621100643966","48758179592976889679941668859434664416","271704414020545291264709723645876203173","100021658481177570287809488875437575150","101465458291593085720592566063727908240","282632327375742991350824327553749157875","3958237280568412598073236381984977996","207176098971761150937219659867631023334","161295664106054709131730742781937414394","22217061272812861539931251390281533398"],"threshold":0.9},"id":"CVE-2025-54385-6846db79","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java"}},{"digest":{"length":136,"function_hash":"77370202772405458445717369808134810712"},"id":"CVE-2025-54385-8c6686fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtils.java","function":"isShortFormStatement"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"countAttachments"},"deprecated":false,"digest":{"function_hash":"146649873470403938937599591439932148404","length":138},"id":"CVE-2025-54385-909b0fa7","signature_type":"Function"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocumentsNames"},"deprecated":false,"digest":{"function_hash":"264689690180264307202988727702023289834","length":302},"id":"CVE-2025-54385-930557e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5"},{"deprecated":false,"digest":{"function_hash":"193011696447342420664751500634081573002","length":202},"id":"CVE-2025-54385-98e3e581","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchAttachments"}},{"id":"CVE-2025-54385-9b5583ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"function":"searchDocuments","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java"},"deprecated":false,"digest":{"function_hash":"150613181484320281725219722076592804549","length":173}},{"digest":{"line_hashes":["272090224881457459008762239553918850644","34740110834908771617930507535799615677","310827031151089562739373603685524120154","226795011496879246674668397895761962028","283806775082930531475230221803794604607","180005294112822231100258766961978949449","333974563594322073616547567539622279513","33003743002465478630591813668497679433","323962891915767702189139495090831255031","190312220973095710854643000099216669094","309426026466320386804633089264128105936"],"threshold":0.9},"id":"CVE-2025-54385-a66d0e06","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtils.java"},"deprecated":false},{"digest":{"function_hash":"150613181484320281725219722076592804549","length":173},"id":"CVE-2025-54385-a6a1ed21","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"},"deprecated":false},{"source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"countAttachments"},"deprecated":false,"digest":{"function_hash":"146649873470403938937599591439932148404","length":138},"id":"CVE-2025-54385-ac8501db","signature_type":"Function","signature_version":"v1"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"},"deprecated":false,"digest":{"function_hash":"125427689649189658504245087717356656798","length":151},"id":"CVE-2025-54385-b92f434c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"},"deprecated":false,"digest":{"function_hash":"135245229564741164769246771792633684521","length":195},"id":"CVE-2025-54385-c06a4cd4"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java","function":"getColumnsForSelectStatement"},"deprecated":false,"digest":{"function_hash":"126168159367393670792274331244718521149","length":518},"id":"CVE-2025-54385-c7c5e9f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51"},{"deprecated":false,"digest":{"function_hash":"22375030463605506561926205117285174833","length":164},"id":"CVE-2025-54385-f6249c45","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocuments"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java","function":"createSQLQuery"},"deprecated":false,"digest":{"function_hash":"166720235714385980491196605768704908396","length":504},"id":"CVE-2025-54385-f6fb15ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"searchDocumentsNames"},"deprecated":false,"digest":{"function_hash":"264689690180264307202988727702023289834","length":302},"id":"CVE-2025-54385-f7afc988","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}