XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.
#DATA-BREACH

Canarytokens is a free tool that helps you discover you’ve been breached by having attackers announce themselves.

Concerned your social security number, date of birth and other sensitive information may be in the NPD Breach?

Discover the latest data breaches on the leading data breach website. See a constantly updated list of recent data breaches and see which companies had a data breach or leak in 2025.

Quickly check if your email has been sold. Report the GDPR-violator, then learn how to prevent this from happening again by scrolling down.

NEW

Stay informed and guard your private data against data breaches. Check if Your Email Address is in a Data Breach.

Welcome to our blog! You’ll find the best opt-out guides, in-depth privacy research, and privacy blog posts here. With the help of our experts, you’ll take the first steps towards taking control of your data privacy.

Check if your email address is in a data breach. Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

Distributed Denial of Secrets (DDoSecrets) is a journalist 501(c)(3) non-profit publishing and archiving leaks, and devoted to the free transmission of data in the public interest.